Elastic Security Labs has uncovered four previously unknown programs tied to the REVSTEALER Windows stealer that persist after the main payload deletes itself. One of these modules disables Windows Update and Microsoft Defender before activating a cryptocurrency miner.

  • REVSTEALER installs four new modules: ProManager, WinUpdate, SoftManager, and an unnamed component
  • WinUpdate disables Windows Update and Microsoft Defender
  • After disabling defenses, a crypto‑miner runs silently on the infected host

Discovery of the Modules

Elastic Security Labs recently documented four never‑before‑seen programs that accompany the emerging Windows information stealer REVSTEALER. These components remain on a compromised machine even after the original stealer self‑destructs, extending the threat’s lifecycle.

Functionality of Each Module

ProManager and SoftManager tweak hidden system settings, weakening the visibility of security tools. WinUpdate specifically turns off Windows Update and Microsoft Defender, stripping the system of critical patches and real‑time protection. The unnamed module then launches a cryptocurrency miner, hijacking CPU/GPU cycles for illicit profit.

Read Also:Progress Confirms Zero-Day Flaw Behind ShareFile Storage Zone Shutdown, Releases Patch

Historical Background

Information‑stealing malware targeting Windows has existed since the early 2000s, but the last two years have seen a surge of modular threats like REVSTEALER that add persistence and profit‑generation layers. Such multi‑module architectures are rare, complicating detection and response for defenders.

Why This Matters

BozokMedia analysis shows that disabling core security services before launching a miner not only maximizes illicit profit but also prolongs the dwell time of the infection, giving threat actors a larger window to exfiltrate data.

"Shutting down Windows Update and Defender is a masterstroke that removes the most basic line of defense," says cybersecurity analyst Maya Patel.
Did You Know?: Crypto‑miner malware incidents rose 68% worldwide in 2023 alone.

Frequently Asked Questions

Q1: Can the REVSTEALER modules be removed?
A: Yes, updating anti‑malware signatures and manually terminating the malicious processes can eradicate them.

Q2: What steps prevent this type of miner infection?
A: Keep Windows Update enabled, use reputable endpoint protection, and avoid executing unknown binaries.