Loading story…
Elastic Security Labs reported that the financially motivated REF1695 operation has used counterfeit software installers since November 2023 to infect victims with remote access trojans and cryptocurrency miners. Recent activity relied on fake ISO files containing a .NET Reactor-protected loader and a text file that led to deployment of a previously undocumented .NET implant called CNB Bot, which can inject additional payloads. The infection chain instructed users to bypass Microsoft Defender SmartScreen, then used PowerShell to add broad Microsoft Defender Antivirus exclusions, launch malware, and display a fake application error to mask the compromise.
Researchers linked the same actor to campaigns delivering PureRAT, PureMiner, a custom .NET-based XMRig loader, and SilentCryptoMiner, with some payloads abusing the vulnerable signed drivers WinRing0x64.sys and Winring0.sys to tune CPU settings and improve mining performance. The operation also used watchdog functions and scheduled tasks for persistence and recovery, communicated with command-and-control servers over HTTP POST, and abused GitHub as a trusted platform for staged payload delivery to reduce detection. Elastic estimated the campaign generated 27.88 XMR across four tracked wallets, worth about $9,392.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs published research detailing REF1695's long-running installer-based malware operation, its use of watchdogs and scheduled tasks for persistence, HTTP POST command-and-control, abuse of vulnerable WinRing0 drivers to optimize mining, and estimated earnings of 27.88 XMR across four tracked wallets. The disclosure tied together the campaign's RAT, miner, and fraud activity under a single tracked cluster.
Researchers identified a newer infection chain in which fake ISO files delivered a .NET Reactor-protected loader and supporting files that led to deployment of the previously undocumented .NET implant CNB Bot. The loader instructed users to bypass Microsoft Defender SmartScreen, used PowerShell to add broad Defender exclusions, and then launched malware while displaying a fake application error.
During the campaign, the actor used ISO files to deliver malware families including PureRAT, PureMiner, a custom .NET-based XMRig loader, and SilentCryptoMiner. Researchers also linked the operation to abuse of GitHub accounts as a trusted payload delivery platform to stage binaries and reduce detection friction.
Elastic Security Labs said the financially motivated REF1695 operation has been active since November 2023, using fake software installers to infect victims with remote access trojans and cryptocurrency miners. The campaign monetizes infections through cryptomining and CPA fraud.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the open-source **XMRig** Monero miner was being folded into broader malware operations, including a "ransominer" chain that monetized victims before any ransom was paid. In one observed intrusion, attackers used a generic Trojan to install administrative tools, create a new user account, enable **RDP** access, deploy **Trojan-Ransom.Win32.Crusis**, and then launch an XMRig loader so the compromised host immediately began generating cryptocurrency for the attackers. Telemetry showed more than **5,000** attempts in August 2020 to install XMRig or modified variants, with **Prometei** and **Cliptomaner** identified as major distributors. Prometei brute-forced **MS SQL** credentials, abused `xp_cmdshell` and **`CVE-2016-0099`**, and used a cross-platform **.NET Core/Apphost** loader to fetch miner payloads for Windows and Linux systems. Cliptomaner, first detected in September 2020, posed as **Realtek** audio software, was written in **AutoIT**, mined cryptocurrency, and also hijacked copied wallet addresses by replacing them with attacker-controlled ones.
Jun 29, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026
Researchers reported a malware campaign delivering a modified **SilentCryptoMiner** alongside a remote access trojan through illegal movie, TV, and digital library websites that pushed fake video player plugin updates. The infection chain used a ZIP archive containing a legitimate executable and a malicious DLL for **DLL side-loading**, then triggered stack-overflow-based ROP decryption and reflective loading to deploy the main module, a watchdog component, the RAT, and CPU/GPU miners. The activity appears to extend operations seen since at least 2022, with refreshed infrastructure and delivery sites but largely unchanged archive structure and execution logic. The malware used **DNS tunneling** and date-based domain generation for execution gating and command-and-control, disabled security and power-saving features when it gained elevated privileges, and established persistence through a fake `GoogleUpdateTaskMachineQC` service; researchers said the campaign had substantial exposure because the affected piracy-related sites drew roughly **40 million visits** in April 2026.
Jun 29, 2026