Indicators of compromise · RevStealer +1 — 8 shown
content[.]brightplaza[.]latmail0[.]runport23[.]latmail[.]spark-trail95[.]xyzscan[.]civicblaze[.]clickhxxps://debug[.]antimalwarediagnostics[.]st:8080/api/miners/submithxxps://debug[.]antimalwarediagnostics[.]st:8080/resources/xmrig0ad68d5804804c25a6f6f3d87cc3a3886583f69b7115ba01ab7c6dd96a186404001816f728d96a823a88e8243cba32486ff0207c123628fa767073bb4a49cd6e
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
REVSTEALER Modules Disable Windows Update and Defender for Crypto Mining
Elastic Security Labs documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer sold commercially since at least February 2026, which remain on an infected machine after the stealer deletes itself. One switches off Windows Update and Microsoft Defender before running a cryptocurrency miner. The findings were published 2 September and freshly surfaced on 6 September.
Summary
The four programs — ProManager, WinUpdate, SoftManager and LockAppHost — respectively steal wallet and browser-extension data, redirect cryptocurrency addresses and capture mnemonic-shaped clipboard content, run a reverse SOCKS5 proxy over an encrypted WebSocket, and deploy XMRig while suspending competitors and establishing persistence. The core stealer exfiltrates browser passwords and cookies, wallets, gaming and messaging data and files. The finding marks a commercial infostealer maturing into a persistent multi-module presence rather than a fire-and-forget credential snatcher.
Impact
- Persistence survives the stealer's self-deletion — a suspected REVSTEALER hit should be treated as a full reimage, not a cleanup
- Windows Update and Defender disabled on affected endpoints before a miner is deployed
- Wallet, credential, browser and messaging data exposure across infected fleets
Sector
Global (Macro)
Sources
- Elastic Security Labs — REVSTEALER ramps up: analysis of up-and-coming infostealer
- raw/digests/Cyber-Digest-2026-09-07.md