INVISIBLE MINERS: UNVEILING GHOSTENGINE'S CRYPTO MINING OPERATIONS

Summary from the TLDR InfoSec newsletter

Elastic Security Labs uncovered an intrusion set named REF4578 with a primary payload called GHOSTENGINE that targeted crypto mining operations by deploying malicious modules and exploiting vulnerable drivers. GHOSTENGINE aims to disable security solutions, establish persistence, and execute a crypto-miner while utilizing elaborate techniques to evade detection and ensure system infection.