Malware News GHOSTENGINE Exploits Vulnerable Drivers to Disable EDRs in Cryptojacking Attack

[silversurfer]

Content source

https://thehackernews.com/2024/05/ghostengine-exploits-vulnerable-drivers.html

Cybersecurity researchers have discovered a new cryptojacking campaign that employs vulnerable drivers to disable known security solutions (EDRs) and thwart detection in what's called a Bring Your Own Vulnerable Driver (BYOVD) attack.

Elastic Security Labs is tracking the campaign under the name REF4578 and the primary payload as GHOSTENGINE. Previous research from Chinese cybersecurity firm Antiy Labs has codenamed the activity as HIDDEN SHOVEL.

"GHOSTENGINE leverages vulnerable drivers to terminate and delete known EDR agents that would likely interfere with the deployed and well-known coin miner," Elastic researchers Salim Bitam, Samir Bousseaden, Terrance DeJesus, and Andrew Pease said. "This campaign involved an uncommon amount of complexity to ensure both the installation and persistence of the XMRig miner."

 

[Andy Ful]

Analysis revealed that this binary executes a hardcoded PowerShell command line to retrieve an obfuscated script, get.png, which is used to download further tools, modules, and configurations from the attacker C2– as depicted in the screenshot below.

It means that the attack can be stopped by blocking outbound connections of PowerShell.
The hardcoded PowerShell command line uses also a type blocked by Constrained Language mode.