Loading threat actor…
REF1695 is a financially motivated cybercrime threat cluster active since at least late 2023 that distributes malware through counterfeit software installers, frequently packaged as ISO images. The operation relies on social engineering to persuade victims to bypass Windows SmartScreen protections and execute trojanized installers that deliver multiple payloads rather than legitimate software. Associated malware includes CNB Bot, PureRAT, PureMiner, SilentCryptoMiner, and a custom .NET-based XMRig loader. REF1695’s campaigns combine remote access and cryptocurrency mining. Its tooling enables persistent access to victim systems, additional payload delivery, and long-term monetization through illicit Monero mining and CPA fraud. The malware is engineered for stealth and durability, including monitoring for security and analysis tools and suspending mining activity when such tools are opened, then resuming afterward. Reported tradecraft also includes use of a processor-access driver to support mining operations, direct system calls for evasion, disabling sleep and hibernation states to maximize mining uptime, and use of trusted platforms such as GitHub to stage payloads and reduce detection friction. Bot communications have also been protected with RSA-2048 encryption. Overall, REF1695 is best characterized as a cybercriminal operation focused on covert resource hijacking and related monetization rather than espionage or destructive activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
37 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
36 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Runs a cryptomining and CPA fraud campaign using fake software installers and ISO files, deploying remote access and mining malware while maintaining long-term persistence and evading detection.
Uses counterfeit installers and ISO lures to deliver remote access trojans and cryptocurrency mining malware, including staged payload delivery via GitHub-hosted binaries.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.