REF1695's ISO Trick: $9K Crypto Haul from Fake Installers and RATs
Forget flashy ransomware. This crew's quietly mined 27.88 XMR — that's $9,392 — by tricking users with ISO lures since late 2023. But the real scam? RATs and fraud on top.
⚡ Key Takeaways
- REF1695 nets $9K+ via ISO-delivered miners, RATs, and CPA fraud since 2023.
- Abuses GitHub as CDN and signed WinRing0 driver for stealth and speed.
- Evolving from single-trick to diversified ops — watch for cross-platform jumps.
🧠 What's your take on this?
Cast your vote and see what Threat Digest readers think
Worth sharing?
Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.
Originally reported by The Hacker News
Related Stories
Ransomware & Malware
0ktapus Phishing Snags 10,000 Credentials Across 130 Companies—Your MFA Is the Weak Link
Ransomware & Malware
Claude Code's 50-Command Cap: The Bypass That Unlocks Your Dev Machine
Ransomware & Malware
FBI, CISA Blast: Russian Phishers Hijacking Signal and WhatsApp Accounts Worldwide
Ransomware & Malware