GhostEngine Malware Disables EDR to Deploy Stealthy XMRig Miners

Researchers disclosed GhostEngine (also called Hidden Shovel), a malware framework used in intrusions tracked by Elastic as REF4578 that disables endpoint detection and response tools before installing a persistent XMRig Monero miner. The infection chain begins with a masqueraded Tiworker.exe that launches a PowerShell loader, clears logs, disables Microsoft Defender, establishes persistence through scheduled tasks and a phantom DLL, and then abuses vulnerable Avast and IObit kernel drivers to kill and delete security agents. Elastic and Antiy both described the operation as a two-stage campaign built to silently remove defenses inside corporate environments and maintain remote access through a PowerShell backdoor.

The campaign used HTTP with backup IPs and FTP with embedded credentials for command-and-control, while miner configuration pointed to pool.supportxmr[.]com and a specific Monero payment identifier that Elastic said was still active at publication. Defenders were urged to watch for suspicious PowerShell execution, unusual file paths, privilege escalation, vulnerable driver loading, event log clearing, and mining-related network traffic. Elastic also published a YARA rule for Windows.Trojan.GhostEngine covering file and memory detection on x86 and arm64 systems, with indicators including C:\Windows\Fonts, WinRing0x64.sys, and the IOBitUnlocker device string.