REF1695 Uses Fake ISO Installers to Deploy RATs, Miners, and CNB Bot

Elastic Security Labs reported that the financially motivated REF1695 operation has used counterfeit software installers since November 2023 to infect victims with remote access trojans and cryptocurrency miners. Recent activity relied on fake ISO files containing a .NET Reactor-protected loader and a text file that led to deployment of a previously undocumented .NET implant called CNB Bot, which can inject additional payloads. The infection chain instructed users to bypass Microsoft Defender SmartScreen, then used PowerShell to add broad Microsoft Defender Antivirus exclusions, launch malware, and display a fake application error to mask the compromise.

Researchers linked the same actor to campaigns delivering PureRAT, PureMiner, a custom .NET-based XMRig loader, and SilentCryptoMiner, with some payloads abusing the vulnerable signed drivers WinRing0x64.sys and Winring0.sys to tune CPU settings and improve mining performance. The operation also used watchdog functions and scheduled tasks for persistence and recovery, communicated with command-and-control servers over HTTP POST, and abused GitHub as a trusted platform for staged payload delivery to reduce detection. Elastic estimated the campaign generated 27.88 XMR across four tracked wallets, worth about $9,392.