Cryptomining Campaigns Disable Security Tools and Abuse Antivirus Update Channels

Researchers reported two distinct cryptomining operations that used stealth and defense-evasion techniques to gain and keep access on victim systems. In the GhostEngine campaign, attackers deployed vulnerable drivers in a bring-your-own-vulnerable-driver (BYOVD) technique to terminate endpoint detection and response products and other security controls, clearing the way for cryptocurrency miners to run on compromised Windows machines. The activity highlighted how legitimate but flawed kernel drivers can be weaponized to disable protections before payload execution.

A separate campaign, GuptiMiner, abused antivirus update mechanisms to distribute backdoors and mining components through what appeared to be trusted software delivery paths. According to researchers, the operation combined supply-chain-style tampering with persistence and remote access, allowing attackers to install additional malware while quietly consuming system resources for mining. Together, the incidents show attackers increasingly pairing cryptomining with privileged evasion methods and trusted update abuse to bypass defenses and monetize compromised endpoints.