Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners
Since November 2023, a financially driven operation known as REF1695 has been seen using phony installers to distribute bitcoin miners and remote access trojans (RATs).
According to an analysis released this week by Elastic Security Labs researchers Jia Yu Chan, Cyril François, and Remco Sprooten, the threat actor monetizes infections through CPA (Cost Per Action) fraud, leading victims to content locker pages under the pretense of software registration.
A previously undocumented.NET implant known as CNB Bot has also been discovered to be delivered by recent rounds of the campaign. These assaults employ an ISO file as the infection vector to send the user a text file with clear instructions on how to get around Microsoft Defender SmartScreen's defenses against running unidentified a...