Researchers Expose ISO Lure Campaign Targeting Enterprises with RATs and Crypto Miners

Introduction

Researchers have uncovered a sophisticated ISO lure campaign that leverages seemingly legitimate disk imaging files to deliver Remote Access Trojans (RATs) and cryptocurrency miners. The attackers disguise malicious ISO images as legitimate backup archives, tricking users into mounting or extracting them. Once executed, the payloads establish persistence, exfiltrate data, and consume system resources for illicit crypto mining. This technique marks a notable shift from traditional malware delivery methods, emphasizing the need for heightened vigilance among IT administrators and security leaders.

How ISO Lures Work

The core of the attack relies on the trust placed in ISO files. Organizations routinely use ISO images for software distribution, OS deployments, and backup archives. Attackers craft these files to appear benign by embedding social engineering cues such as company logos, official naming conventions, or references to internal projects. When a user double‑clicks the ISO, the system may automatically mount it, prompting execution of hidden scripts or binaries embedded within the image. In many cases, the attackers rely on native OS utilities like mount or PowerShell to extract and run malicious payloads without raising immediate suspicion.

Why This Campaign Is Dangerous

Several factors elevate this campaign’s risk profile:

• Stealthy Initial Access: The use of legitimate ISO files bypasses many perimeter defenses that focus on executable binaries.
• Dual Threat Payload: Victims receive both a RAT for remote control and a crypto miner that monetizes compromised resources.
• Lateral Movement Potential: Once inside, the RAT can harvest credentials, enabling further exploitation across the network.
• Persistence Mechanisms: The malicious components often embed themselves in scheduled tasks or startup locations, ensuring continued operation even after reboot.

For modern enterprises, the convergence of data theft and resource hijacking creates a compounded impact: confidential information may be exfiltrated while critical infrastructure experiences degraded performance, leading to potential downtime and financial loss.

Technical Breakdown of the RAT and Crypto Miner

The discovered payload chain typically follows this sequence:

1. ISO Extraction: The victim mounts the ISO, triggering an autorun script or a disguised installer.
2. Loader Execution: A lightweight dropper loads a malicious DLL into memory, evading traditional antivirus heuristics.
3. RAT Deployment: The loader retrieves a Cobalt Strike or QuasarRAT variant, establishing a reverse shell to the attacker’s command‑and‑control server.
4. Crypto Miner Installation: Concurrently, a Monero or Raven miner is installed, configuring CPU and GPU usage to maximize hash rate.
5. Persistence Setup: Registry keys, scheduled tasks, or WMI event subscriptions are created to ensure the components survive reboots.

Understanding each stage enables security teams to craft targeted detection rules and response playbooks.

Immediate Detection and Containment Steps

When an incident is suspected, follow this rapid response checklist:

• Isolate Affected Systems: Disconnect the endpoint from the network to prevent command‑and‑control communication.
• Collect Artefacts: Capture memory dumps, disk images, and process listings to preserve evidence.
• Search for ISO Files: Use endpoint detection tools to locate recently accessed or mounted ISO images.
• Scan for Known Indicators: Look for hash values associated with the identified RAT and miner binaries.
• Terminate Suspicious Processes: Stop any unknown executables consuming high CPU or GPU resources.
• Audit Scheduled Tasks and Services: Review entries for anomalies matching the persistence tactics observed.

Quick execution of these steps can limit the attacker’s foothold and mitigate potential damage.

Preventive Controls Checklist

Proactive measures are essential to reduce the likelihood of a successful ISO lure attack. Implement the following controls:

• Restrict ISO Execution: Deploy application control policies that prevent automatic execution of ISO content.
• Email Filtering: Block attachments with .iso extensions from external senders unless explicitly whitelisted.
• User Awareness Training: Educate staff on the dangers of mounting unexpected ISO files and the importance of verifying file sources.
• Endpoint Detection & Response (EDR): Enable behaviours such as anomalous CPU/GPU usage alerts and script execution monitoring.
• Network Segmentation: Isolate critical servers and workstations to limit lateral movement after initial compromise.
• Patch Management: Keep operating systems and virtualization tools up to date to close known vulnerabilities that could be leveraged for ISO exploitation.
• Least Privilege Principle: Ensure users operate with minimal permissions, reducing the attacker’s ability to install persistent components.

Adopting these controls creates layered defenses that significantly raise the cost for adversaries attempting ISO‑based attacks.

Conclusion

The emergence of ISO lure campaigns underscores the evolving sophistication of threat actors who blend legitimate file formats with malicious intent. By understanding the mechanics of these attacks, recognizing early warning signs, and applying robust preventive strategies, organizations can safeguard against both data exfiltration and resource hijacking. Investing in professional IT management and advanced security frameworks not only protects critical assets but also enhances operational resilience, ensuring that businesses can focus on growth rather than remediation.