Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners

Elastic Security Labs uncovered a financially motivated threat campaign (REF1695) using ISO file lures to distribute RATs and cryptocurrency miners since November 2023.

• •Infection vector is a fake ISO installer that prompts users to bypass Microsoft Defender SmartScreen via 'More info' and 'Run anyway' clicks
• •A new undocumented .NET implant called CNB Bot acts as a loader, communicating with C2 via HTTP POST and supporting payload download, self-update, and cleanup
• •Campaigns deploy PureRAT, PureMiner, XMRig loader, and SilentCryptoMiner; the latter disables Windows Sleep/Hibernate and persists via scheduled tasks
• •WinRing0x64.sys, a legitimate but vulnerable Windows kernel driver, is abused to modify CPU settings and boost mining hash rates
• •GitHub is abused as a payload delivery CDN, hosting malicious binaries to reduce detection by shifting downloads away from attacker-controlled infrastructure
• •Four tracked wallets accumulated 27.88 XMR (~$9,392), confirming consistent finan

This summary was automatically generated by AI based on the original article and may not be fully accurate.