Solved Nasty New Malware

glasskuter · May 22, 2024

This devious malware can turn off your security protection without you even realizing — and then download a load of cryptominers

After terminating the AVs, REF4578 downloads cryptominers

www.techradar.com

neemobeer · May 23, 2024

More detailed article. Researchers spot cryptojacking attack that disables endpoint protections

andrew129260 · May 23, 2024

Pretty clever. Using an old vulnerable avast driver as well as IObitUnlockers.sys unlocker.

I do wonder if UAC being set at its highest level would prevent this attack + windows defender tamper protection. And if the default powershell protections would prevent it from running. Would a user specifically need to allow anything for it to work......

Would like to find it to test with....

This has more info which I am still reading through

Invisible miners: unveiling GHOSTENGINE’s crypto mining operations — Elastic Security Labs

Elastic Security Labs has identified REF4578, an intrusion set incorporating several malicious modules and leveraging vulnerable drivers to disable known security solutions (EDRs) for crypto mining.

www.elastic.co

Microsoft created the Vulnerable Driver Blocklist to stop admins from tampering with the kernel, but they've done nothing about an admin-to-kernel exploit chain that was reported over 11 months ago. By removing the vulnerable driver requirement from EDRSandBlast via GodFault, I hope to prove that admin-to-kernel exploits can be just as dangerous as vulnerable drivers and that MSRC needs to take them seriously. Given Windows 11's goal of default security and the fact that the Vulnerable Driver Blocklist is now enabled by default, MSRC needs to reconsider its policy of indifference towards PPL and kernel exploits.

Yeah.....I agree