GhostEngine Mining Attacks Kill EDR Security Using Vulnerable Drivers

A malicious crypto mining campaign codenamed ‘REF4578,’ has been discovered deploying a malicious payload named GhostEngine that uses vulnerable drivers to turn off security products and deploy an XMRig miner.