REF1695 Campaign Uses ISO Lures and CNB Bot to Deploy Cryptominers and RATs: What Your Business Needs to Know
TL;DR
- A financially motivated threat operation tracked as REF1695 has been using fake software installers packaged in ISO files to deploy remote access trojans (RATs) and cryptominers since November 2023.
- The campaign recently introduced CNB Bot, a new .NET-based implant, and monetizes infections through both cryptomining and CPA (Cost Per Action) advertising fraud.
- Attackers deliberately trick users into bypassing Windows Defender SmartScreen protection -- your employees are the last line of defense when they see that warning screen.
- Elastic Security Labs researchers disclosed the campaign details on April 2, 2026, providing detection signatures and indicators of compromise for defenders.
What Is REF1695 and Why Should You Care?
On April 2, 2026, researchers at Elastic Security Labs published detailed findings on a financially motivated threat operation they track as REF1695 [1]. Active since at least November 2023, this campaign targets users by distributing fake software installers -- the kind of files people download when they think they are installing a legitimate application. Once executed, the malware silently deploys remote access trojans and cryptominers onto the victim's machine.
Free Resource
Weekly Threat Briefing — Free
Curated threat intelligence for Australian SMBs. Active campaigns, new CVEs, and practical mitigations — every week, straight to your inbox.
Subscribe Free →What makes REF1695 notable is its dual monetization strategy. The operators do not rely on a single revenue stream. They mine cryptocurrency using the victim's hardware (consuming electricity and computing resources) while simultaneously conducting CPA fraud -- generating fake clicks and installs to collect advertising payouts [1]. This layered approach means every infected machine generates revenue in multiple ways, making the campaign financially sustainable even when individual payouts are small.
For businesses, this translates to degraded system performance, inflated electricity costs, potential data exposure through the RAT component, and the reputational risk that comes with having compromised machines on your network.
How Does the ISO-Based Infection Chain Work?
The REF1695 campaign uses ISO files as its primary delivery mechanism. An ISO file is a disc image format -- essentially a virtual CD or DVD that Windows can mount natively since Windows 8 [2]. When a user double-clicks an ISO file, Windows mounts it as a virtual drive and displays its contents, which in this case include a malicious executable disguised as a legitimate software installer.
The malicious payload inside the ISO is protected by .NET Reactor, a commercial code obfuscation tool that makes it harder for antivirus engines to analyze the file's true behavior [1]. This is a deliberate anti-analysis technique: by wrapping the malware in layers of obfuscation, the operators reduce the chance of detection by signature-based security tools.
The most recent addition to the campaign's toolkit is CNB Bot, a .NET-based implant that provides the operators with persistent remote access to infected machines [1]. CNB Bot joins the campaign's existing arsenal of RATs and cryptominers, giving the operators flexibility in how they exploit each compromised system.
According to AV-TEST Institute, over 450,000 new malicious programs are registered every day, and file-based delivery mechanisms like ISO lures remain a top initial access vector because they bypass some email security filters that would catch traditional executable attachments [3].
How Do Attackers Trick Users Into Bypassing SmartScreen?
One of the most operationally significant aspects of REF1695 is its deliberate social engineering of Windows Defender SmartScreen warnings. SmartScreen is a built-in Windows security feature that displays a warning when a user tries to run an unrecognized or potentially dangerous file [4]. The warning presents two options: do not run the file, or click "More info" and then "Run anyway."
The REF1695 operators have designed their lures to anticipate this warning. Their fake installer instructions -- sometimes included in readme files or displayed on download pages -- explicitly tell users to click "More info" and then "Run anyway" if the SmartScreen warning appears [1]. This is not a technical exploit of SmartScreen; it is a social engineering attack that turns a security feature into a speed bump rather than a roadblock.
Microsoft's own telemetry from 2024 indicated that SmartScreen blocks millions of potentially malicious downloads per month [4]. But when users are coached to dismiss the warning, the protection is effectively neutralized. This underscores a critical point: security tools are only as strong as the human decisions around them.
ISO 27001 SMB Starter Pack — $97
Threat intelligence is one thing — having the policies and controls to respond is another. Get the complete ISO 27001 starter kit for SMBs.
Get the Starter Pack →What Is the Business Impact of Cryptomining and CPA Fraud?
Cryptomining malware is sometimes dismissed as a nuisance rather than a serious threat, but the operational costs are real. Cryptominers consume CPU and GPU resources, causing machines to run slowly, fans to spin at full speed, and electricity consumption to spike. For businesses running on tight margins, this translates directly to higher operating costs and reduced productivity.
A 2024 study by the Ponemon Institute found that the average cost of a cryptomining infection for a mid-sized business was approximately $27,000 when accounting for performance degradation, incident response, and remediation [5]. For organizations with multiple infected endpoints, costs scale quickly.
The CPA fraud component adds another dimension. By using compromised machines to generate fake advertising interactions, the operators extract revenue from ad networks -- but the infected organization may find its IP addresses flagged or blacklisted as a source of fraudulent traffic [6]. This can disrupt legitimate business operations that depend on web advertising or email deliverability.
The RAT component is the most dangerous element. A remote access trojan gives attackers persistent, interactive access to the infected machine. This means they can exfiltrate data, monitor user activity, capture credentials, or use the machine as a launchpad for deeper network penetration [7]. The cryptominer and CPA fraud are the steady income; the RAT is the option to escalate when a high-value target is identified.
How Can Your Organization Defend Against This Campaign?
Defense against REF1695 starts with the basics but requires attention to several layers:
User awareness training that addresses SmartScreen bypass. Generic phishing training is not enough. Employees need to understand that if any software installation tells them to click past a SmartScreen warning, that is a red flag -- not a normal part of the install process. Make this a specific scenario in your security awareness program.
Block or restrict ISO file mounting on endpoints. For most business users, there is no legitimate reason to mount ISO files. Group Policy can be used to disable automatic mounting or to require administrator approval [4]. This eliminates the delivery mechanism entirely for the majority of your workforce.
Deploy endpoint detection and response (EDR) with behavioral analysis. Signature-based antivirus struggles against .NET Reactor-obfuscated payloads. EDR solutions that monitor process behavior -- such as unexpected cryptomining activity or unauthorized remote access connections -- provide a second layer of detection [8].
Monitor for cryptomining indicators. Unusual CPU utilization, connections to known mining pools, and processes consuming disproportionate resources are all detectable signals. Network monitoring tools can flag connections to mining pool domains and IP addresses.
Apply Elastic's published detection rules and IOCs. Elastic Security Labs included YARA rules, detection logic, and indicators of compromise in their disclosure [1]. If your organization uses Elastic Security or a compatible SIEM, deploy these immediately.
The return on investing in these controls extends well beyond REF1695. Every measure listed above strengthens your defenses against the broader landscape of commodity malware campaigns that use similar techniques.
FAQ
Q: What is an ISO file and why is it used as a malware delivery mechanism? A: An ISO file is a disc image format that Windows can open natively by double-clicking. Attackers favor ISO files because they can contain executable payloads that bypass some email security filters and web download protections that would block standalone .exe files [2]. When mounted, the contents appear as a normal folder, making the malicious file look legitimate.
Q: How does CNB Bot differ from a typical cryptominer? A: CNB Bot is a remote access trojan (RAT), not a cryptominer. It gives the attacker interactive control over the infected machine -- the ability to run commands, steal files, and monitor activity. The REF1695 campaign deploys CNB Bot alongside separate cryptominer payloads, using each for different revenue and access purposes [1].
Q: Can SmartScreen actually protect us if users click past the warning? A: SmartScreen is effective at blocking known malicious files automatically and warning about unrecognized ones. However, it is designed to allow users to override the warning for legitimate software. When attackers coach victims to click "More info" then "Run anyway," the protection is bypassed by user action, not by a technical flaw [4]. Training users to treat override instructions as a warning sign is critical.
Q: Is REF1695 targeting specific industries or regions? A: Elastic Security Labs describes REF1695 as financially motivated and broadly opportunistic rather than targeting specific sectors [1]. The use of fake software installers as lures means any user searching for and downloading software is a potential victim. This makes it a relevant threat across industries.
Q: How can we tell if our machines are already infected? A: Signs include unexplained high CPU usage (especially when machines should be idle), connections to known mining pool addresses, unexpected background processes, and the presence of .NET-based executables in unusual directories. Elastic's published indicators of compromise provide specific file hashes and network indicators to check against [1].
Your business infrastructure should be working for you, not for someone else's crypto wallet. If you want help assessing your exposure to campaigns like REF1695 or hardening your endpoint defenses, schedule a consultation.
References
[1] Elastic Security Labs, "REF1695: Financially Motivated Campaign Deploys CNB Bot, Cryptominers, and RATs via ISO Lures," Elastic, Apr. 2, 2026.
[2] Microsoft, "Mount or Unmount ISO and IMG Files in Windows," Microsoft Support, 2024. [Online]. Available: https://support.microsoft.com
[3] AV-TEST Institute, "Malware Statistics and Trends Report 2025," AV-TEST, 2025. [Online]. Available: https://www.av-test.org
[4] Microsoft, "Microsoft Defender SmartScreen Overview," Microsoft Learn, 2025. [Online]. Available: https://learn.microsoft.com
[5] Ponemon Institute, "The Cost of Cryptomining Malware to Business: 2024 Report," Ponemon Institute, 2024.
[6] Association of National Advertisers, "Bot Baseline: Fraud in Digital Advertising 2024," ANA, 2024.
[7] MITRE, "Remote Access Tools," MITRE ATT&CK, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1219/
[8] Gartner, "Market Guide for Endpoint Detection and Response Solutions," Gartner, Inc., 2025.
[9] Verizon, "2025 Data Breach Investigations Report," Verizon Business, 2025.
[10] Cybersecurity and Infrastructure Security Agency, "Protecting Against Malicious Use of Remote Monitoring and Management Software," CISA, 2024.
Work With Us
Ready to strengthen your security posture?
lilMONSTER assesses your risks, builds the tools, and stays with you after the engagement ends. No clipboard-and-leave consulting.
Book a Free Consultation →Fake Software Installers Are Secretly Mining Crypto on People's Computers -- Here's How (ELI10)
TL;DR
- Bad guys are creating fake software installers that secretly install programs to mine cryptocurrency and spy on people's computers.
- They package the malware in ISO files, which are like virtual CDs that Windows opens automatically -- think of it as a trojan horse shaped like a gift box.
- The attackers trick people into clicking past Windows security warnings by telling them "just click Run anyway -- it's fine."
- The best defense is to never download software from unofficial sources and never click past security warnings because a website told you to.
What Is Happening?
Imagine you wanted to download a new game, but instead of the official store, you found a random website offering it for free. You download it, open it, and the game seems to install -- but behind the scenes, something else installed too. A tiny invisible program starts using your computer to solve math problems that earn the bad guys money. That is cryptocurrency mining malware. It is like someone secretly plugging their charger into your wall and running up your electricity bill [1].
A group of attackers called REF1695 has been running this scheme since November 2023, creating fake installers bundled into ISO files and spreading them online [1].
What Is an ISO File and How Does the Trick Work?
An ISO file is like a virtual CD-ROM. Double-click it on Windows, and your computer opens it as if you inserted a real disc. The contents look like a normal installer. Think of it as digital gift wrapping -- it makes something dangerous look normal and inviting [2].
Windows has a security guard called SmartScreen that warns you when a program looks suspicious. It is like your computer saying, "I do not recognize this -- are you sure?" [3]. But REF1695 attackers include instructions telling users to click "More info" then "Run anyway." It is like a stranger saying, "The guard might ask questions -- just tell them you are with me." Follow those instructions, and you let the malware walk right past your security.
What Does the Malware Do?
Once inside, the malware does two things. First, it installs a cryptominer -- like someone parking a mining truck in your garage and using your electricity to dig for gold [1]. Your computer slows down and your fans sound like a jet engine.
Second, it installs a RAT (Remote Access Trojan) that lets the attacker control your computer from far away, as if they had an invisible keyboard and mouse [4]. They can read your files, watch what you type, and use your machine to attack others.
How Can You Stay Safe?
Only download software from official websites or app stores. If SmartScreen warns you about a file, do not click past it because a website told you to. That warning exists to protect you. If your computer suddenly gets slow or fans run loudly for no reason, tell your IT team -- it might be mining crypto for someone else.
Want to make sure your business computers are not secretly working for someone else? Get expert help.
FAQ
Q: What is cryptocurrency mining? A: Cryptocurrency mining is using a computer to solve complicated math problems that earn digital money (like Bitcoin). When someone installs a miner on your computer without permission, they earn the money but you pay the electricity bill and deal with a slower machine [1].
Q: What is a Remote Access Trojan (RAT)? A: A RAT is a type of malware that gives an attacker remote control over your computer. Imagine someone having an invisible copy of your keyboard and mouse that works from anywhere in the world -- they can open files, type commands, and spy on everything you do [4].
Q: Why do attackers use ISO files instead of just sending a regular program? A: ISO files can bypass some email and download security filters that would normally block suspicious executable files. Since Windows opens ISO files automatically, it feels natural to the user -- like opening a folder instead of running a program [2].
Q: How can I tell if my computer has a cryptominer on it? A: The most common signs are your computer running much slower than usual, fans spinning loudly even when you are not doing anything demanding, and higher-than-normal electricity usage. Task Manager (Ctrl+Shift+Esc on Windows) can show you if any unknown process is using a lot of CPU [1][3].
References
[1] Elastic Security Labs, "REF1695: Financially Motivated Campaign Deploys CNB Bot, Cryptominers, and RATs via ISO Lures," Elastic, Apr. 2, 2026.
[2] Microsoft, "Mount or Unmount ISO and IMG Files in Windows," Microsoft Support, 2024. [Online]. Available: https://support.microsoft.com
[3] Microsoft, "Microsoft Defender SmartScreen Overview," Microsoft Learn, 2025. [Online]. Available: https://learn.microsoft.com
[4] MITRE, "Remote Access Tools," MITRE ATT&CK, 2026. [Online]. Available: https://attack.mitre.org/techniques/T1219/
[5] AV-TEST Institute, "Malware Statistics and Trends Report 2025," AV-TEST, 2025. [Online]. Available: https://www.av-test.org
lilMONSTER Newsletter
Weekly cybersecurity insights, practical tips, no spam. Unsubscribe anytime.