Threats · 166 days ago

REF1695 campaign update

REF1695 runs a financially motivated campaign deploying RATs, custom XMRig loaders, and CPA fraud via fake installer packages since late 2023. Infections use.

Timeline

• Apr 2 Reported by The Hacker News
• Mar 31 Reported by Elastic Security Labs

Sources

2 sources covering this story

• The Hacker News Apr 2

  Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners

  REF1695 spreads RATs and miners since Nov 2023 via ISO lures, earning 27.88 XMR across four wallets through cryptomining and CPA fraud.

• Elastic Security Labs Mar 31

  Fake Installers to Monero: A Multi-Tool Mining Operation — Elastic Security Labs

  Elastic Security Labs dissects a long-running operation deploying RATs, cryptominers, and CPA fraud through fake installer lures, tracking its evolution across campaigns and Monero payouts.

Entities

• REF1695

Part of the PlainSec briefing for 2026-04-03

Editions

• Briefing for 2026-04-03
• Briefing for 2026-04-02

Related stories

• UNC1069 Expands Node.js Supply Chain Attacks Beyond Axios
• TeamPCP Compromises LiteLLM PyPI Package, Steals Credentials
• State-Backed Hackers Target Personal Messaging Apps to Bypass Corporate Controls