GhostEngine mining attacks kill EDR security using vulnerable drivers

A crypto-mining campaign named REF4578 uses a staged loader (Tiworker.exe downloading a PowerShell script get.png) to install GhostEngine, which disables endpoint security by loading vulnerable kernel drivers (aswArPots.sys, IObitUnlockers.sys), creates persistence via scheduled tasks and a service-loaded DLL (oci.dll), and deploys XMRig for covert mining; Elastic Security and Antiy published detection guidance and YARA rules but the actor and target scope remain unattributed.