Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
- ID
- 21942
- Status
- summarized
- Published
- 06 Sep 2026, 4:34 PM
- Fetched
- 06 Sep 2026, 7:38 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 2.0
- Created
- 06 Sep 2026, 7:39 PM
- Tags
- Audience
- developers
What happened
Elastic Security Labs documented four programs linked to the REVSTEALER Windows infostealer—ProManager, WinUpdate, SoftManager, and LockAppHost—that persist after the core stealer self-deletes. One module disables Windows Update and Microsoft Defender before launching a crypto miner; others steal wallet files, swap clipboard crypto addresses, and turn the host into a reverse proxy. Elastic noted the connection rests on shared build tradecraft (same packer, runtime function resolution, Polygon smart contracts for config backup), not an observed hand-off on live hosts.
Why it matters
This is detailed malware tradecraft analysis but has no direct bearing on AI/ML tooling, agent frameworks, or SaaS infrastructure that this audience builds with. Unless you ship Windows endpoint security software or manage corporate Windows fleets, there is no action to take here.
Discussion angle
Skip this segment unless someone in the group manages Windows endpoint protection; the shared-tradecraft angle (Polygon smart contracts for C2 config) is the only mildly novel detail worth a one-line mention.