Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
Four REVSTEALER modules disable Windows Update and Defender to run a crypto miner.
Elastic Security Labs has identified four new modules linked to the REVSTEALER information stealer. These modules persist on infected systems after REVSTEALER self-deletes, with one specifically disabling Windows Update and Microsoft Defender to run a cryptocurrency miner. The modules, named ProManager, WinUpdate, SoftManager, and LockAppHost, share build techniques with REVSTEALER and target various sensitive data including cryptocurrency wallets and credentials.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Elastic?
Get an email when a new story names Elastic, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe REVSTEALER malware family deploys persistent modules that actively disable Windows Update and Microsoft Defender, stripping away two of the most fundamental layers of endpoint protection before launching a cryptocurrency miner. This attack highlights a critical risk: when security controls can be silently disabled by malware, organizations lose both their defenses and their visibility into ongoing compromise. The self-deletion behavior of the initial stealer combined with persistent secondary modules makes detection and remediation significantly harder. Allowing endpoint security software to be tampered with by unprivileged processes represents a serious configuration gap that threat actors routinely exploit.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — REVSTEALER
- malware — ProManager
- malware — WinUpdate
- malware — SoftManager
- malware — LockAppHost