Loading story…
Researchers disclosed GhostEngine (also called Hidden Shovel), a malware framework used in intrusions tracked by Elastic as REF4578 that disables endpoint detection and response tools before installing a persistent XMRig Monero miner. The infection chain begins with a masqueraded Tiworker.exe that launches a PowerShell loader, clears logs, disables Microsoft Defender, establishes persistence through scheduled tasks and a phantom DLL, and then abuses vulnerable Avast and IObit kernel drivers to kill and delete security agents. Elastic and Antiy both described the operation as a two-stage campaign built to silently remove defenses inside corporate environments and maintain remote access through a PowerShell backdoor.
The campaign used HTTP with backup IPs and FTP with embedded credentials for command-and-control, while miner configuration pointed to pool.supportxmr[.]com and a specific Monero payment identifier that Elastic said was still active at publication. Defenders were urged to watch for suspicious PowerShell execution, unusual file paths, privilege escalation, vulnerable driver loading, event log clearing, and mining-related network traffic. Elastic also published a YARA rule for Windows.Trojan.GhostEngine covering file and memory detection on x86 and arm64 systems, with indicators including C:\Windows\Fonts, WinRing0x64.sys, and the IOBitUnlocker device string.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Elastic's protections-artifacts repository showed an update commit for the Windows.Trojan.GhostEngine YARA rule, making the detection artifact publicly available in the GitHub project.
At the time of publication, Elastic observed evidence of active miners still connected to the tracked Monero payment ID, indicating the GhostEngine campaign remained operational.
Elastic Security Labs disclosed intrusion set REF4578 and its GhostEngine malware framework, while Antiy independently reported the same activity as Hidden Shovel. The campaign was described as using vulnerable drivers to disable EDR tools, establish persistence, deploy a backdoor, and install the XMRig Monero miner.
Elastic last modified its Windows.Trojan.GhostEngine YARA rule, updating the detection artifact before public reporting on the malware framework.
Elastic Security created a YARA rule for Windows.Trojan.GhostEngine to detect the malware in Windows files or memory using GhostEngine-related strings and binary signatures.
Antiy reported that the cryptomining malware campaign it calls '匿铲'/'Hidden Shovel' had been active since November 2023 and had evolved through multiple upgrades to version 3.0. The report also said infections were still increasing at the time of reporting.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 37 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
5 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceantiy.com
Open sourcedarkreading.com
Open sourceelastic.co
Open sourceaon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported two distinct cryptomining operations that used stealth and defense-evasion techniques to gain and keep access on victim systems. In the **GhostEngine** campaign, attackers deployed vulnerable drivers in a bring-your-own-vulnerable-driver (`BYOVD`) technique to terminate endpoint detection and response products and other security controls, clearing the way for cryptocurrency miners to run on compromised Windows machines. The activity highlighted how legitimate but flawed kernel drivers can be weaponized to disable protections before payload execution. A separate campaign, **GuptiMiner**, abused antivirus update mechanisms to distribute backdoors and mining components through what appeared to be trusted software delivery paths. According to researchers, the operation combined supply-chain-style tampering with persistence and remote access, allowing attackers to install additional malware while quietly consuming system resources for mining. Together, the incidents show attackers increasingly pairing cryptomining with privileged evasion methods and trusted update abuse to bypass defenses and monetize compromised endpoints.
Jul 12, 2026
Researchers reported that **GhostMiner** evolved into a fileless cryptocurrency-mining malware strain that abuses **Windows Management Instrumentation (WMI)** for persistence, payload execution, and evasion on Windows systems. The malware stores Base64-encoded PowerShell in a WMI class named `PowerShell_Command`, installs WMI event subscriptions to relaunch itself, drops a Monero miner as `C:\Windows\Temp\lsass.exe`, and maintains backdoor communication with command-and-control infrastructure including `118.24.63.208` and `103.105.59.68`. The campaign also aggressively removes rival cryptominers by terminating competing processes and services, deleting scheduled tasks, blocking related network traffic, and altering hosts file entries tied to families such as **MyKings**, **PowerGhost**, **PCASTLE**, and **BULEHERO**. The activity aligns with the broader **MITRE ATT&CK `T1546.003`** technique, which documents WMI event subscription abuse as a persistence method used by multiple malware families and threat actors, underscoring how GhostMiner weaponized native Windows management features to remain resident while monopolizing infected hosts for illicit Monero mining.
Aug 15, 2026
Kaspersky reported that the open-source **XMRig** Monero miner was being folded into broader malware operations, including a "ransominer" chain that monetized victims before any ransom was paid. In one observed intrusion, attackers used a generic Trojan to install administrative tools, create a new user account, enable **RDP** access, deploy **Trojan-Ransom.Win32.Crusis**, and then launch an XMRig loader so the compromised host immediately began generating cryptocurrency for the attackers. Telemetry showed more than **5,000** attempts in August 2020 to install XMRig or modified variants, with **Prometei** and **Cliptomaner** identified as major distributors. Prometei brute-forced **MS SQL** credentials, abused `xp_cmdshell` and **`CVE-2016-0099`**, and used a cross-platform **.NET Core/Apphost** loader to fetch miner payloads for Windows and Linux systems. Cliptomaner, first detected in September 2020, posed as **Realtek** audio software, was written in **AutoIT**, mined cryptocurrency, and also hijacked copied wallet addresses by replacing them with attacker-controlled ones.
Jun 29, 2026