ChatGPT Clues and OPSEC Errors Expose EncryptHub Ransomware Operators

EncryptHub is a financially motivated cybercriminal group linked to 600+ global incidents that operate multi-stage campaigns using trojanized applications, PowerShell scripts, custom stealers (Stealc, Rhadamanthys) and ransomware (files encrypted with an ".crypted" extension). The report highlights the group’s use of ChatGPT to assist in malware development and campaign planning, exploitation of CVEs, and significant OPSEC failures (exposed directory listings, plaintext credentials, misconfigured Telegram bots) that allowed researchers to recover IOCs (file hashes, domains, IPs) and map their TTPs; defenders are advised to monitor those IOCs and strengthen endpoint defenses and training.