Larva-208

THREAT ACTOR PROFILE

Larva-208

EncryptHub

Larva-208, widely tracked as EncryptHub, is a Russia-linked crew that blends social engineering with malware delivery and extortion. It impersonates IT support over Microsoft Teams and phone, abuses a Windows MMC flaw, and hides stealers in trojanized apps and Steam games, having compromised hundreds of organizations while leaving a trail of OPSEC mistakes.

Country:

Russia-linked

eCrime / Extortion

First seen

2024

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Larva-208, EncryptHub and Water Gamayun

Larva-208 is tracked under several vendor names tied to its social-engineering operations. It maps to one entry among the Russia-linked crews we track, and its IT-impersonation tradecraft overlaps with social-engineering crews like Scattered Spider.

GROUP PROFILE

Social engineering into stealers and extortion

Larva-208 is a financially motivated crew that gets in by talking its way past people. It poses as IT staff, walks victims through running PowerShell, and deploys stealers and backdoors, while also seeding malware through trojanized software and games.

Our record ties it to social-engineering campaigns and stealer deployment. Trustwave and others documented EncryptHub impersonating IT support over Microsoft Teams and abusing a Windows MMC flaw, with reporting noting more than 600 compromised organizations.

The group's tradecraft spans vishing and Teams lures, fake AI platforms targeting Web3 developers, the SilentCrystal loader, SOCKS5 proxy backdoors, and stealers like Fickle, Stealc, Vidar and Rhadamanthys.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

IT impersonation into stealer deployment

The stages below come from Larva-208 and EncryptHub activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

Fickle Stealer, SilentCrystal and the stealer set

Initial Access

CVES EXPLOITED

Windows MMC and file-handling flaws

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

CVE-2026-21509

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Teams impersonation, Steam games and fake AI platforms

Recent reporting tracks the group's social-engineering campaigns.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through