Invisible miners: unveiling GHOSTENGINE’s crypto mining operations

Elastic Security Labs documents the REF4578 intrusion set (primary payload GHOSTENGINE), detailing a complex cryptomining campaign that uses vulnerable third-party drivers to terminate and delete endpoint security agents, deploys persistent scheduled tasks and a service DLL backdoor, and installs XMRig for Monero mining; the report includes module analyses, IoCs (file hashes, domains, IPs), and miner payment identifiers for tracking.