As cited
Copy frozen at (site build).
threat intel
Fake Installers to Monero: A Multi-Tool Mining Operation
Elastic Security Labs analyzed a sustained malware campaign distributing remote access trojans (RATs), cryptominers, and cost-per-action fraud tools via counterfeit installer files. The operation evolved across multiple campaigns and generated revenue through Monero payouts.
Why it matters: Practitioners deploying endpoint detection and response (EDR) solutions and monitoring installer vectors should review Elastic's indicators of compromise (IOCs) to detect or block this active infrastructure, as the campaign continues to target users through social engineering.
- Source published
- First seen by Cybersecurity Tracker