The cybersecurity landscape continues to evolve with increasingly sophisticated financially motivated threat actors. One such operation, tracked as REF1695, has been actively targeting users since late 2023. This campaign stands out for its layered infection chains, consistent tooling, and hybrid monetization model combining cryptomining with Cost-Per-Action (CPA) fraud.
This blog breaks down the technical architecture, infection strategies, and operational scale of REF1695, offering valuable insights for security professionals and researchers.
Overview of the REF1695 Operation
REF1695 is a coordinated malware campaign leveraging fake software installers to deliver a mix of Remote Access Trojans (RATs), cryptominers, and custom loaders. Despite variations across campaigns, several consistent patterns link all observed activity to a single operator:
- Use of Themida/WinLicense and .NET Reactor for obfuscation
- Deployment via ISO-based fake installers
- Shared command-and-control (C2) infrastructure
- Social engineering tactics encouraging users to bypass security warnings
The operation’s dual monetization strategy is particularly notable. In addition to mining cryptocurrency (primarily Monero), victims are redirected to CPA content lockers disguised as registration steps, generating additional revenue streams.
ReadMe.txt lure, Source : Elastic
Campaign Evolution and Payload Delivery
Campaign 1: CNB Bot Deployment
The most recent campaign introduces CNB Bot, a previously undocumented .NET implant. Delivered via ISO files, the infection begins with a loader that:
- Adds Microsoft Defender exclusions
- Drops and executes a secondary payload
- Displays a fake installation error to avoid suspicion
CNB Bot features:
- RSA-2048 signed task validation
- AES-encrypted communication
- Scheduled task persistence
Its modular design allows operators to execute commands such as payload download, updates, and self-removal.
Campaign 2: PureRAT Infection Chain
A second campaign pivots to PureRAT v3.0.1, introducing a multi-stage loader architecture:
- Initial loader sets Defender exclusions
- Stage 2 extracts additional payloads
- Stage 3 executes an in-memory PE loader
The malware uses PBKDF2-SHA1 to derive encryption keys and communicates with multiple fallback C2 servers. Observed behavior includes automatic download and execution of cryptomining payloads hosted on GitHub.
Campaign 3: Multi-Payload Deployment
This variant expands functionality by deploying:
- PureRAT
- PureMiner
- Custom XMRig loader
To maximize mining efficiency, the malware disables system sleep and hibernation. It also profiles GPU hardware using libraries like nvapi64.dll and atiadlxx.dll.
A key innovation is the “hide-and-seek” evasion mechanism, where the miner halts when analysis tools (e.g., Task Manager, Wireshark) are detected, resuming only when the system appears idle.
Campaign 4: SilentCryptoMiner Variant
Another branch uses SilentCryptoMiner, a more advanced loader that:
- Uses direct syscalls to evade detection
- Injects payloads into legitimate processes like
explorer.exe - Maintains persistence via scheduled tasks or registry keys
It also deploys a watchdog process to reinstall itself if removed, ensuring long-term persistence.
Advanced Evasion and Persistence Techniques
Across all campaigns, REF1695 employs sophisticated evasion strategies:
- Defender exclusion abuse to bypass antivirus
- Process injection into trusted binaries
- Kernel-level access via
WinRing0x64.sys - VM detection mechanisms to avoid sandbox analysis
Persistence is typically achieved through scheduled tasks configured with high privileges, often disguised as legitimate system processes.
Cryptomining Infrastructure and Financial Insights
The operator’s reliance on public Monero mining pools provides rare visibility into financial outcomes. Analysis of four wallets reveals:
- Over 27.88 XMR (~$9,392 USD) in payouts
- Multiple active workers across campaigns
- Continuous low-volume mining activity
This “low-and-slow” approach avoids detection while ensuring steady revenue generation.
Abuse of Trusted Platforms
A notable tactic is the use of GitHub as a payload delivery platform. By hosting malicious binaries on legitimate infrastructure, the attacker reduces suspicion and bypasses traditional filtering mechanisms.
Payloads linked to GitHub accounts include:
- Custom XMRig loaders
- PureMiner binaries
- CNB Bot variants
- Additional RATs like AsyncRAT and Pulsar RAT
Automation in Malware Analysis
Interestingly, the research leveraged an AI-driven pipeline to automate payload extraction and configuration analysis. This system:
- Recursively traced infection chains
- Decompiled .NET binaries
- Generated custom extraction scripts
While effective, challenges included high computational cost and occasional context drift, highlighting both the promise and limitations of AI-assisted reverse engineering.
Key Takeaways
- REF1695 is a multi-layered, financially motivated campaign with consistent tooling
- Combines cryptomining and CPA fraud for diversified monetization
- Uses advanced obfuscation and evasion techniques
- Demonstrates long-term operational success with minimal noise
Our Perspective on REF1695
REF1695 represents a shift toward efficient, low-visibility cybercrime operations rather than large-scale disruptive attacks. Instead of ransomware or data theft, the operator focuses on sustainable monetization, quietly exploiting system resources over time.
What makes this campaign particularly concerning is its blend of technical sophistication and psychological manipulation. The use of fake installers and social engineering lowers the barrier to infection, while advanced techniques like RSA-signed tasking and kernel-level access ensure resilience against detection and removal.
Additionally, the abuse of trusted platforms like GitHub highlights a growing challenge in cybersecurity: attackers leveraging legitimate infrastructure to mask malicious intent. This trend complicates detection and raises questions about platform responsibility.
From a defensive standpoint, REF1695 underscores the importance of behavioral detection over signature-based approaches. Traditional antivirus solutions are insufficient against threats that dynamically adapt and hide their activity.
Ultimately, this campaign is a reminder that cybercriminals are optimizing for longevity and stealth, not just impact. Organizations and individuals must adopt proactive security practices, including monitoring system anomalies, restricting execution policies, and educating users about social engineering risks.
