Invisible miners: unveiling GHOSTENGINE’s crypto mining operations

As cited

Copy frozen at 2026-09-19 06:17 UTC (site build).

threat intel

Invisible miners: unveiling GHOSTENGINE’s crypto mining operations

Elastic Security Labs identified REF4578, an intrusion set that uses malicious modules and vulnerable drivers to disable endpoint detection and response (EDR) solutions, enabling cryptomining operations. The campaign, tracked as GHOSTENGINE, employs driver exploitation to evade security detection.

Why it matters: Organizations running EDR solutions are at risk of having their protections disabled, allowing cryptomining malware to consume resources undetected; security teams should review driver exploit mitigations and monitor for unusual CPU activity.

Source published

2024-05-22 00:00 UTC

First seen by Cybersecurity Tracker

2026-09-19 05:23 UTC