Librarian Ghouls carry out attacks with data theft and crypto miner deployment

Librarian Ghouls, also tracked as "Rare Werewolf" and "Rezet", is an APT group targeting entities in Russia and the CIS, and its recent campaign relies on legitimate third-party software rather than custom malware. The attacks begin with phishing emails containing password-protected archives disguised as payment orders, which install tools including AnyDesk, Blat and 4t Tray Minimizer. The malicious batch script sets an AnyDesk password, disables Windows Defender with Defender Control, and creates a task that shuts the PC down daily at 5 AM. It also steals cryptocurrency wallet data and registry hives, emails them to attackers, and installs an XMRig crypto miner.