Librarian Ghouls Turn Russian Devices Into Crypto Miners

Crypto News Exploits

Librarian Ghouls Turn Russian Devices Into Silent Crypto Miners

Written by Aaron S.,

Editor-In-Chief

Last Updated: June 11, 2025

Key Takeaways

Rare Werewolf hackers use fake emails to install malware and take control of Russian computers for crypto mining;
The group schedules infected devices to run overnight, stealing data and mining crypto while staying hidden;
Most victims are in Russia, with some in Belarus and Kazakhstan; the campaign has been active since December 2024.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

Librarian Ghouls Turn Russian Devices Into Silent Crypto Miners

BITDEGREE IN YOUR SOCIAL FEED

A hacker group known as Librarian Ghouls, also known as Rare Werewolf, has taken control of hundreds of computers in Russia to secretly mine cryptocurrency, according to a Kaspersky report on June 9.

The group uses phishing emails containing malicious files to gain unauthorized access to systems. These emails look like regular messages from real companies and often contain what appear to be invoices or official documents.

Once opened, the file installs malware that gives hackers remote access. From there, they disable built-in protections, such as Windows Defender.

Crypto Mining Explained: How to Earn From Mining Bitcoin? (Animated)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

Kaspersky reported that the infected computers are programmed to turn on at 1 AM and shut down at 5 AM.

This quiet time window allows hackers to stay hidden while accessing the device, gathering passwords, and preparing it to mine cryptocurrency. The attackers also examine the system’s details, such as memory, processor speed, and graphics card, to configure the mining tool.

While mining is active, the device contacts the mining pool every minute to remain connected.

Kaspersky stated that the group also installs tools to stay connected to the machine long-term. Additionally, they often use fake websites to trick users into giving away their email account access.

The campaign began in December 2024 and is still ongoing. It has mostly affected Russian users, especially those at industrial companies and technical schools. A smaller number of victims have been found in Belarus and Kazakhstan.

Recently, the Mobile Threat Intelligence team at ThreatFabric reported that the Android malware Crocodilus is targeting banking and cryptocurrency users in several regions. How does it work? Read the full story.