Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, a Windows information stealer. One of these modules, ProManager, disables Windows Update and Microsoft Defender before executing a cryptocurrency miner. The modules remain on the machine after the stealer deletes itself, providing persistent access for malicious activities.

What should defenders do?

Ensure Windows is up to date with the latest security updates. Use updated antivirus or endpoint detection and response (EDR) solutions to detect and remove REVSTEALER and its associated modules. Monitor for unauthorized processes named ProManager, WinUpdate, or SoftManager. Implement network segmentation and application whitelisting where possible.

highMalware

REVSTEALER Associated Modules Disable Windows Update and Defender for Crypto Mining

Elastic Security Labs identifies four persistence modules, one of which disables security controls on compromised Windows systems.

CyberIntel DeskPublished 24 days agoUpdated less than a minute ago1 min read

REVSTEALER Associated Modules Disable Windows Update and Defender for Crypto Mining

Key Takeaways

Four previously unreported persistence modules have been associated with the REVSTEALER information stealer.
One module, ProManager, disables Windows Update and Microsoft Defender to enable cryptocurrency mining.
The modules persist on the machine after the main stealer deletes itself, providing long-term access.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read