[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI1uSwxg2qvEPnRiBKO6014z61JDCqqjQY-wUsRjM7lY":3},{"article":4,"iocs":50,"watch_terms":66,"solutions":67,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"81894df3-7042-4b99-890c-32cce617dd4b","Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner","four-revstealer-linked-modules-disable-windows-update-and-defender-to-run-a-cryp-1a8ef3","Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of them switches off Windows Update and Microsoft Defender before running a cryptocurrency miner. The company named the four programs ProManager, WinUpdate, SoftManager, and","Elastic Security Labs has identified four new modules linked to the REVSTEALER information stealer. These modules persist on infected systems after REVSTEALER self-deletes, with one specifically disabling Windows Update and Microsoft Defender to run a cryptocurrency miner. The modules, named ProManager, WinUpdate, SoftManager, and LockAppHost, share build techniques with REVSTEALER and target various sensitive data including cryptocurrency wallets and credentials.","Four REVSTEALER modules disable Windows Update and Defender to run a crypto miner.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ffour-revstealer-linked-modules-disable.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhpRcdfXd6kYnqLLWSFdzGKICUzSr90MsV2f3PXtw8VDVcT-xOP2w4HwnVzrRI4bdJqhboQMFIm9BZ393b89IOqgYx-VVmb_B8-XJCsZ9SAIymdlBpEf5ARizHvn32t8Mr9stzV6nMVcn3utUYI1xSRxhaC29QZjS-C3haNSRPfQI_eBYzXCrwn5rl18Nw\u002Fs1600\u002Frev.jpg","2026-09-06T08:34:20+00:00","2026-09-06T10:00:12.904135+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"Windows Update","product",{"name":21,"type":19},"Microsoft Defender",{"name":23,"type":24},"cryptocurrency miner","technology",{"name":26,"type":27},"Elastic","vendor",{"name":29,"type":24},"Electron framework",{"name":31,"type":24},"CMSTP tool","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,54,57,60,63],{"type":36,"value":52,"context":53},"REVSTEALER","Emerging Windows information stealer and associated modules",{"type":36,"value":55,"context":56},"ProManager","REVSTEALER-linked module stealing wallet files and logging passwords",{"type":36,"value":58,"context":59},"WinUpdate","REVSTEALER-linked module replacing cryptocurrency addresses in clipboard",{"type":36,"value":61,"context":62},"SoftManager","REVSTEALER-linked module turning victim into a reverse proxy",{"type":36,"value":64,"context":65},"LockAppHost","REVSTEALER-linked module disabling defenses and running crypto miner",[26,18,21],{"controls":68,"vendors":145},[69,98,119],{"slug":70,"name":71,"problem":72,"products":73},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":99,"name":100,"problem":101,"products":102},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[103,111],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,132,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":133,"product_name":134,"url":135,"description":136},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[146,151],{"slug":147,"name":26,"logo_path":148,"roles":149},"elastic","\u002Fvendor-logos\u002Felastic.png",[150],"reported_by",{"slug":112,"name":113,"logo_path":114,"roles":152},[153],"affected",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":171},"revstealer-modules-disable-windows-defender-and-update-to-deploy-crypto-miner","REVSTEALER Modules Disable Windows Defender and Update to Deploy Crypto Miner","The REVSTEALER malware family deploys persistent modules that actively disable Windows Update and Microsoft Defender, stripping away two of the most fundamental layers of endpoint protection before launching a cryptocurrency miner. This attack highlights a critical risk: when security controls can be silently disabled by malware, organizations lose both their defenses and their visibility into ongoing compromise. The self-deletion behavior of the initial stealer combined with persistent secondary modules makes detection and remediation significantly harder. Allowing endpoint security software to be tampered with by unprivileged processes represents a serious configuration gap that threat actors routinely exploit.",[159,160,161,162,163,164,165,166,167,168,169,170],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF DE.CM-4: Malicious code is detected","MITRE ATT&CK T1562.001: Impair Defenses – Disable or Modify Tools","MITRE ATT&CK T1490: Inhibit System Recovery","MITRE ATT&CK T1496: Resource Hijacking (Cryptomining)",{}]