Researchers have uncovered Operation STANDOFF, a Russian-speaking cybercrime campaign that uses a pay-per-install loader to disable Microsoft Defender, deploy several malware families, and establish long-term access through a fake csrss.exe process. The operation combines credential theft, cryptocurrency mining, proxy-botnet activity, targeted corporate intrusion tooling, and AI-assisted influence operations on shared infrastructure. The infection begins with […]
The post Operation STANDOFF Disables Windows Defender and Installs Persistent Fake csrss.exe appeared first on Cyber Security News.