Minacce e avversari · Cryptojacking
REF1695 conduce una campagna a scopo finanziario distribuendo RAT, loader XMRig personalizzati e frodi CPA tramite pacchetti di installazione falsi dalla fine del 2023. Le infezioni utilizzano.
2 fonti · 2 apr
The Hacker News
Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners
REF1695 spreads RATs and miners since Nov 2023 via ISO lures, earning 27.88 XMR across four wallets through cryptomining and CPA fraud.
originaleElastic Security Labs
Fake Installers to Monero: A Multi-Tool Mining Operation — Elastic Security Labs
Elastic Security Labs dissects a long-running operation deploying RATs, cryptominers, and CPA fraud through fake installer lures, tracking its evolution across campaigns and Monero payouts.
originalePart of the PlainSec briefing for 2026-04-02
Every edition of this story: Aggiornamento campagna REF1695