Decrypting the Inner DNS Workings of EncryptHub

Rising cybercriminal entity EncryptHub seems to have unknowingly exposed elements of its malicious enterprise. An Outpost24 investigation unveiled new aspects of the group’s infrastructure, tools, and behavioral patterns.

The security researchers were able to take a peek into the threat actors’ stealer logs, malware executables, PowerShell scripts, and Telegram bot configurations. These errors shed light on the group’s operations, including their attack chain and methodologies.¹

Outpost24 identified 20 indicators of compromise (IoCs) that WhoisXML API expanded through a DNS deep dive.

Our in-depth analysis of the EncryptHub IoCs led to the discovery of new connected artifacts comprising:

• 64 email-connected domains, one of which turned out to be malicious
• 10 additional IP addresses, seven of which have already been tagged as malicious
• 71 IP-connected domains, one of which has already been weaponized for attacks
• 419 string-connected domains, seven of which have already figured in malicious campaigns

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://outpost24.com/blog/unveiling-encrypthub-multi-stage-malware/