🦠 Ransomware & Malware

REF1695's ISO Trick: $9K Crypto Haul from Fake Installers and RATs

Forget flashy ransomware. This crew's quietly mined 27.88 XMR — that's $9,392 — by tricking users with ISO lures since late 2023. But the real scam? RATs and fraud on top.

Attack chain diagram showing REF1695 ISO lure deploying CNB Bot and XMRig miner

⚡ Key Takeaways

  • REF1695 nets $9K+ via ISO-delivered miners, RATs, and CPA fraud since 2023. 𝕏
  • Abuses GitHub as CDN and signed WinRing0 driver for stealth and speed. 𝕏
  • Evolving from single-trick to diversified ops — watch for cross-platform jumps. 𝕏
Published by

Threat Digest

Threat intelligence. Zero noise.

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by The Hacker News

Stay in the loop

The week's most important stories from Threat Digest, delivered once a week.