Ankura CTIX FLASH Update - May 24, 2024

Ransomware/Malware Activity

GhostEngine Crypto Mining Malware Kills EDR Processes

Security researchers at Elastic Security Labs and Antiy have discovered and detailed a new crypto mining malware campaign named "REF4578" which uses vulnerable drivers to disable common Endpoint Detection and Response (EDR) software. The main malware deployed in the attack is named GhostEngine, which is initially staged by an executable named "Tiworker.exe". "Tiworker.exe" downloads GhostEngine's primary loader named "get.png" which downloads additional modules, disables Windows Defender, clears Windows event logs, and creates scheduled tasks for persistence. The "get.png" loader also launches GhostEngine's primary payload called "smartsscreen.exe" which terminates and deletes EDR software prior to launching the main crypto miner executable. GhostEngine terminates the EDR software running on the victim machine by leveraging two (2) vulnerable drivers: "aswArPots.sys" (an Avast