Librarian Ghouls is a apt_group tracked across 1 threat cluster and 1 intelligence report mention on ThreatCluster. First observed July 7, 2026; most recent activity July 7, 2026.
A spear-phishing campaign targets the aerospace sector, impersonating the Russian research institute VNIIR. Attackers use a spoof domain (vniir-avia.space) to deliver a password-protected RAR archive containing a…