Elastic Security Labs documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on infected machines after the main malware deletes itself. Researchers reported the discovery on September 6, noting that the persistence modules include components that disable Windows Update and Microsoft Defender before running a cryptocurrency miner.
The modules are named ProManager, WinUpdate, SoftManager, and a fourth component whose name was not disclosed. Systems infected with REVSTEALER suffer both credential theft and ongoing cryptocurrency mining that degrades performance while leaving security defenses disabled.
REVSTEALER Persistence Modules Survive Main Stealer Deletion to Maintain Long-Term Access
REVSTEALER operates in two stages: an initial information stealer that harvests credentials and system data, followed by persistence modules that remain active after the main stealer removes itself. This architecture separates the high-value credential theft operation from the longer-term monetization through cryptocurrency mining.
By deleting the main stealer component, REVSTEALER reduces its forensic footprint and evades detection systems focused on the stealer’s initial infection signatures. The persistence modules use different file names and execution patterns, making them appear unrelated to the original infection. Organizations that detect and remove the REVSTEALER stealer may believe they have cleaned the infection while the persistence modules continue operating.
How REVSTEALER’s WinUpdate and ProManager Modules Disable Windows Security Before Crypto Mining
One of the documented modules disables both Windows Update and Microsoft Defender before launching a cryptocurrency mining payload. Switching off Windows Update prevents the system from receiving security patches that could close the vulnerabilities or malware delivery mechanisms that enabled the initial infection. Disabling Microsoft Defender removes the primary antivirus protection that might detect the cryptocurrency miner or other malicious activity.
The module names—WinUpdate, ProManager, SoftManager—mimic legitimate Windows system services and management tools. This naming convention helps the malware blend into process lists and avoid suspicion during manual system reviews. Administrators who notice these processes may mistake them for legitimate software, especially when the modules run with service-level privileges that suggest they are part of the operating system.
Cryptocurrency mining on infected systems generates revenue for attackers while degrading victim system performance. CPU and GPU resources are consumed by mining operations, leading to slower application response, reduced battery life on laptops, and increased electricity costs. In enterprise environments, widespread mining across multiple infected endpoints can generate noticeable network traffic to mining pools and trigger performance complaints that lead to discovery.
Organizations Must Monitor for Unauthorized Windows Security Modifications and Unusual CPU Usage
Endpoint detection should specifically look for processes that modify Windows Update or Microsoft Defender settings outside of authorized administrative actions. Group Policy or enterprise management tools legitimately control these settings, but individual executables disabling security features represent strong indicators of malware activity.
Monitoring for unusual CPU usage patterns can detect cryptocurrency mining activity. Mining software consumes sustained high CPU or GPU resources, unlike typical business applications that show variable load based on user activity. Detection systems should flag processes that maintain elevated resource consumption for extended periods without corresponding user interaction.
Organizations should implement policies that prevent unauthorized modification of Windows security settings. Even with local administrator privileges, critical security features should be protected through Tamper Protection or similar mechanisms that require additional authentication steps before changes take effect. These controls make it more difficult for malware to disable defenses, even when the malware runs with elevated privileges.
The persistence module architecture—remaining active after the main malware deletes itself—demonstrates an evolution in information stealer design. Early info stealers focused solely on credential extraction and exfiltration. REVSTEALER adds a secondary monetization layer that continues generating value for attackers long after the initial data theft, while simultaneously weakening the victim’s security posture by disabling update and antivirus protections.
Incident response procedures should assume that removal of the primary malware component does not constitute full remediation. When REVSTEALER or similar multi-stage malware is detected, responders must search for associated persistence mechanisms, secondary payloads, and disabled security features. Simply removing the initial stealer leaves the cryptocurrency mining modules and disabled defenses in place, allowing the infection to continue in a degraded but still harmful state.
