REVSTEALER-Linked Persistence Modules (ProManager, WinUpdate, SoftManager, and Unnamed Cryptominer Loader)

Technical Analysis

The malware family REVSTEALER deploys secondary payloads named ProManager, WinUpdate, SoftManager, and a fourth unnamed module that establish persistence independent of the initial stealer component, allowing continued access even after primary infection artifacts are removed. One module manipulates Windows Update and Microsoft Defender settings—likely via registry modification, service disabling, or policy tampering—to prevent detection and patching while a cryptocurrency miner executes in the background, consuming system resources. This defense-evasion technique suggests threat actors are prioritizing durable, low-noise monetization (mining) alongside credential theft, increasing dwell time and reducing remediation visibility. Since REVSTEALER is an infostealer, any credentials, API keys, tokens, or session cookies harvested from infected endpoints could expose secrets used by AI agent frameworks, LLM orchestration tools, or RAG pipelines running on the same host, and disabled Defender/Update states on such hosts materially raises the risk of further compromise or unauthorized cryptomining on infrastructure supporting agentic workloads.

Affected Systems

Windows endpoints and servers running Microsoft Defender and Windows Update services; systems previously or currently infected with REVSTEALER; hosts where security agent tampering (Defender/WU disablement) is possible via administrative or SYSTEM-level access

Indicators of Compromise

• ProManager (file/module name)
• WinUpdate (file/module name)
• SoftManager (file/module name)
• Fourth unnamed persistence module (name not disclosed in source)
• Associated with REVSTEALER infostealer campaign

Remediation Steps

1. 1

   Verify Defender and Windows Update status

   Audit endpoints for unauthorized changes to Windows Defender and Windows Update service states, registry keys, and group policy settings; re-enable and enforce via tamper protection.

2. 2

   Hunt for REVSTEALER artifacts

   Search endpoints for the named modules (ProManager, WinUpdate, SoftManager) and unusual persistence mechanisms such as scheduled tasks, services, or startup entries introduced after initial infection.

3. 3

   Rotate exposed credentials

   Assume any credentials, API keys, or tokens present on infected hosts—including those used by AI agent or automation tooling—are compromised and rotate them immediately.

4. 4

   Detect and remove cryptominer processes

   Monitor for abnormal CPU/GPU utilization and known mining process signatures; terminate and remove unauthorized mining binaries.

5. 5

   Enable tamper protection and monitoring

   Deploy EDR with tamper protection enabled to prevent security tool disablement, and alert on Defender/Windows Update configuration changes.

6. 6

   Review agent and automation host security

   For hosts running AI agents, LLM tool integrations, or RAG pipelines, verify no secrets were exfiltrated and confirm security controls were not disabled by this malware family.