Loading threat actor…
REF4578 is an unattributed financially motivated cryptomining intrusion set tracked for deploying the GHOSTENGINE malware framework, portions of which are also known as HIDDENSHOVEL. Its objective is to install and maintain XMRig for Monero mining while suppressing endpoint defenses. The operation uses a masqueraded Windows executable to launch a PowerShell-based loader that retrieves modular components and configuration data. GHOSTENGINE disables Microsoft Defender, clears Windows event logs, identifies installed EDR products, and uses vulnerable kernel drivers to terminate EDR processes and remove their binaries. It also employs a redundant in-memory security-tool termination component. Persistence is established through recurring scheduled tasks and phantom-DLL loading. A PowerShell backdoor supports encoded command exchange and remote command execution. The framework uses multiple download and command-and-control transfer mechanisms and can remove artifacts associated with earlier infections. No threat actor, source country, victim organization, or targeted country has been publicly attributed with high confidence.
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
19 indicators attributed to this actor. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.