EncryptHub breaches 618 orgs to deploy infostealers, ransomware

**Executive summary:** EncryptHub (tracked as Larva-208) is a sophisticated financially motivated threat actor active since June 2024 that uses SMS/voice spear-phishing and fake VPN login pages to harvest credentials and MFA session tokens, then deploys RMM tools, multiple infostealers, and a custom PowerShell-based encryptor (files appended with ".crypted") across at least 618 organizations, demanding USDT via Telegram.