Search: “Elastic Defend”

11 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 29 Vulnerability 17 Ransomware 17 Exploit / PoC 11 Industry 10 Data breach 8 Policy & legal 6 Phishing & fraud 5 Threat actor 4 Research 4 AI safety & security 1 AI industry 1 Advisory 1 Tools 1

SeverityAll critical 54 high 24 medium 20 low 10 info 8

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic documents four persistent REVSTEALER-linked tools (ProManager, WinUpdate, SoftManager, LockAppHost); LockAppHost disables Windows Update and Defender to run a crypto miner.

Elastic Security Labs identified four previously unreported executables tied to REVSTEALER, a commercial Windows infostealer sold since at least February 2026: ProManager, WinUpdate, SoftManager, and LockAppHost. LockAppHost abuses CMSTP for elevation, adds Microsoft Defender exclusions, disables five Windows Update services and 13 scheduled tasks, then hides a miner in legitimate Windows processes; other modules steal wallets, clipboard-swap crypto addresses, and turn victims into reverse proxies. The components share REVSTEALER tradecraft including packer, runtime function resolution, and Polygon smart-contract backup configuration (EtherHiding). Elastic's detection rule matched about 4,700 VirusTotal samples over the past year; distribution uses hijacked YouTube channels promoting game cheats and a fake 'Claude Opus 5 Free Desktop' app.

The Hacker NewsSep 6, 08:34 UTC · 10d agoMalware in the wild

Elastic Security 7.9 delivers a major milestone toward endpoint security integrated into the Elastic Stack

Help Net SecurityAug 20, 00:00 UTC · Aug 20, 2020Malware

Infostealer with hVNC capability pushed via Google Ads

Help Net SecurityMay 2, 00:00 UTC · May 2, 2023Malware

The most prevalent malware behaviors and techniques

Help Net SecurityMar 20, 00:00 UTC · Mar 20, 2024Malware

Researchers Uncover 'Process Ghosting' — A New Malware Evasion Technique

The Hacker NewsJun 17, 08:05 UTC · Jun 17, 2021Malware

Uncovering attacker tactics through cloud honeypots

Help Net SecurityApr 23, 13:46 UTC · Apr 23, 2026Malware

TeamTNT Targeting AWS, Alibaba

Cisco TalosApr 21, 12:49 UTC · Apr 21, 2022Malware

Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners

The Hacker NewsApr 2, 11:42 UTC · Apr 2, 2026Malware

KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension

Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.

Elastic researchers tracked the KREMLIN banking malware operation across seven campaigns over 15 months, infecting 1,515 systems, 98.75% of them in Brazil. Portuguese-language lures posing as bank records and invoices deploy a hostile 'AVSync' extension into Chrome and Edge profiles that harvests passwords, session cookies, keystrokes and screenshots. Loaders check for sandboxes, create scheduled tasks and fetch fresh infrastructure from an Ethereum smart contract; a network canary takeover temporarily disrupted infections.

Cyber Security News08:12 UTC · 8h agoMalware in the wild

New IDAT Loader Attacks Using Steganography to Deploy Remcos RAT

The Hacker NewsFeb 26, 15:53 UTC · Feb 26, 2024Malware

Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware

The Hacker NewsMar 24, 04:17 UTC · Mar 24, 2026Malware