Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners

**REF1695** is a financially motivated campaign active since November 2023 that uses ISO-based fake installers to deploy RATs, multiple cryptocurrency miners (including SilentCryptoMiner and a bespoke XMRig loader), and a new .NET loader named CNB Bot; the actor uses PowerShell to create Defender exclusions, hosts payloads on GitHub as a trusted CDN, abuses a signed vulnerable kernel driver (WinRing0x64.sys) to increase mining performance, and maintains persistence/watchdog mechanisms — the campaign has yielded an estimated 27.88 XMR (~$9,392).