Loading malware…
GhostEngine, also known as Hidden Shovel, is a Windows-based modular cryptomining malware framework associated with the REF4578 intrusion set. It is designed to deploy and maintain XMRig for Monero mining while suppressing endpoint defenses. The framework uses a masqueraded executable and PowerShell-based loader to retrieve modules and configuration data over HTTP, with fallback infrastructure and FTP support. Its components can disable Microsoft Defender, clear Windows event logs, remove remnants of earlier infections, enable remote services, and establish redundant scheduled-task and DLL-based persistence.
GhostEngine identifies installed EDR products and abuses vulnerable third-party kernel drivers to terminate EDR processes and delete their binaries, constituting bring-your-own-vulnerable-driver activity. A redundant memory-resident component continuously monitors for and terminates security processes. The framework also includes a PowerShell backdoor that exchanges encoded system information and commands with command-and-control infrastructure, enabling remote command execution. Its operators have not been publicly identified, and no specific victim organizations or industries have been confirmed.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
GHOSTENGINE is responsible for retrieving and executing modules on the machine. It primarily uses HTTP to download files from a configured domain, with a backup IP in case domains are unavailable. Additionally, it employs FTP as a secondary protocol with embedded credentials.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Detection rules and behavior prevention events associated with the campaign include the following: ... local scheduled task creation
get.png creates SYSTEM scheduled tasks named OneDriveCloudSync, DefaultBrowserUpdate, and OneDriveCloudBackup to execute oci.dll, re-download get.png, and run smartsscreen.exe.
It also includes a PowerShell script that functions like a backdoor, enabling remote command execution on the system.
Tiworker.exe executes a hardcoded PowerShell command to retrieve the obfuscated get.png script; get.png orchestrates module download and execution.
The oci.dll persistence component causes msdtc to spawn a PowerShell one-liner, and detection coverage includes Svchost spawning Cmd.
The PowerShell script creates oci.dll, described as a phantom DLL loaded by msdtc; whenever the msdtc service starts, it loads oci.dll and executes get.png.
Detection rules and behavior prevention events associated with the campaign include the following: ... local scheduled task creation
get.png creates SYSTEM scheduled tasks named OneDriveCloudSync, DefaultBrowserUpdate, and OneDriveCloudBackup to execute oci.dll, re-download get.png, and run smartsscreen.exe.
the researchers recommended that organizations prioritize the detection and prevention of these initial actions ... including ... deploying vulnerable drivers and establishing associated kernel mode services.
Detection rules and behavior prevention events associated with the campaign include the following: ... local scheduled task creation
get.png creates SYSTEM scheduled tasks named OneDriveCloudSync, DefaultBrowserUpdate, and OneDriveCloudBackup to execute oci.dll, re-download get.png, and run smartsscreen.exe.
the researchers recommended that organizations prioritize the detection and prevention of these initial actions ... including: ... elevating privileges to system integrity
the researchers recommended that organizations prioritize the detection and prevention of these initial actions ... including ... deploying vulnerable drivers and establishing associated kernel mode services.
leveraging vulnerable drivers to disable known security solutions (EDRs)
The intrusion begins with a PE named Tiworker.exe, masquerading as the legitimate Windows TiWorker.exe file.
clearn.png removes prior campaign artifacts and scheduled tasks; get.png clears Windows Temp, Windows Logs, $Recycle.Bin, and a trace file, and can delete large files to create storage space.
smartsscreen.exe uses vulnerable Avast aswArPots.sys with IOCTL 0x7299C004 to terminate EDR processes and vulnerable IObitUnlockers.sys with IOCTL 0x222124 to delete EDR binaries.
The PowerShell script creates oci.dll, described as a phantom DLL loaded by msdtc; whenever the msdtc service starts, it loads oci.dll and executes get.png.
get.png attempts to disable Windows Defender, while smartsscreen.exe and kill.png terminate and delete known EDR agent processes and binaries.
get.png clears Application, Security, Setup, System, Forwarded Events, and several Microsoft-Windows operational event-log channels.
smartsscreen.exe scans running processes against a hardcoded list of known EDR agents; kill.png continuously scans for newly started processes.
GHOSTENGINE primarily uses HTTP to download files from a configured domain; backup.png sends encoded host information and command results while awaiting commands.
GHOSTENGINE employs FTP as a secondary protocol with embedded credentials.
GHOSTENGINE retrieves get.png and subsequently downloads tools, modules, configurations, vulnerable drivers, and XMRig from attacker C2 infrastructure.
The EDR controller terminates matching security-agent processes, and kill.png continuously scans for and terminates newly observed security processes.
smartsscreen.exe downloads and executes the XMRig client and configuration, starting Monero mining; the stated ultimate objective is deployment of a persistent Monero miner.
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.