Novel EDR-Killing 'GhostEngine' Malware Is Built for Stealth

GhostEngine, attributed to an intrusion set labeled REF4578, is a modular C++ malware used in a cryptomining campaign that leverages vulnerable drivers to terminate and delete EDR agents, establish persistence, deploy a backdoor, and install the XMRig Monero miner. Researchers (Elastic Security Labs and Antiy Labs) observed initial execution via a trojanized TiWorker.exe that launches PowerShell orchestration, downloads modules and configurations from C2, and performs log clearing, Defender tampering, and other evasive actions; detection guidance focuses on suspicious PowerShell, unusual execution paths, driver loading, and mining-related network traffic.