Operation STANDOFF: Multi-Payload Malware Loader Disables Windows Defender via Fake csrss.exe Persistence
August 10th, 2026
High
Our Cyber Threat Intelligence Unit is monitoring Operation STANDOFF, an active, financially motivated cybercrime campaign that researchers characterize as Russian-speaking based on tooling and infrastructure artifacts. The campaign centers on a pay-per-install loader, distributed as setupx86x64install.exe, that drops 40 to 50 additional executables and persists via a fake csrss.exe process while disabling Windows Defender and Windows Update to extend attacker dwell time. Delivered payloads, including RedLine Stealer, Raccoon Stealer, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig, allow credential theft, cryptocurrency mining, and proxy-botnet enrollment. Victims are drawn in partly through a Russian-language gaming portal, Mobile Arena, that targets Standoff 2 and PUBG Mobile players with free-skin offers, promo codes, and gambling referrals. Campaign infrastructure, hosted by Russian provider TimeWeb Ltd. (AS9123) across at least 44 servers, conceals command-and-control traffic behind GitHub redirects and also runs a multi-operator intrusion console (STANDOFF COORD) used to coordinate targeted Active Directory access, a Telegram account-farming operation, and an AI-driven multi-channel outreach platform that integrates email, Google Sheets, an LLM (reported as Anthropic's Claude), Telegram, and WhatsApp. Organizations should treat this as an active threat capable of escalating from opportunistic credential theft to targeted enterprise intrusion.
Technical Details
Threat Type: Multi-layered cybercriminal operation combining a pay-per-install malware loader, a proxy-botnet, a multi-operator intrusion console, a Telegram account-farm, and an AI-driven multi-channel outreach platform.
Severity: High.
No CVE or vendor CVSS rating applies, since this is a malware-loader and criminal-infrastructure campaign rather than a software vulnerability. The rating reflects confirmed credential theft, security-control tampering, and infrastructure built for targeted Active Directory intrusion (STANDOFF COORD).
Affected Systems: Windows endpoints running Microsoft Defender; broader enterprise environments given credential theft and lateral movement risk.
Threat Actors: Financially motivated cybercriminal group; researchers characterize it as Russian-speaking based on tooling, forum, and infrastructure artifacts, sometimes referencing campaign branding such as “GG Influence” or “ggstandoff.” Not attributed to a named or state-sponsored APT.
Exploit Status: Not applicable; no associated CVE. Confirmed active via VMRay execution-level analysis; not listed in the CISA Known Exploited Vulnerabilities catalog.
Attack Chain / Method:
Initial Access / Lure: A Russian-language gaming portal, Mobile Arena, hosted on campaign infrastructure at 217.198.13[.]211, targets Standoff 2 and PUBG Mobile players with free-skin offers, promo codes, and gambling-site referrals, functioning as a top-of-funnel lure toward the loader. The sample analyzed is a 32-bit NSIS installer, setupx86x64install.exe, acting as a multi-payload loader.
Payload Staging: Drops approximately 40 to 50 executables with randomized names into %LOCALAPPDATA%\7zSCB82E89C and launches them via repeated hidden cmd.exe processes, using code injection and process hollowing.
Defense Evasion: PowerShell disables Defender real-time monitoring, sample submission, and MAPS reporting, and excludes the staging directory; also attempts to stop or delete Windows Update and checks for security products from Avast, AVG, Bitdefender, ESET, Kaspersky, Norton, Panda, and Sophos.
Anti-Analysis: Checks for virtual machines, Wine, Sandboxie, and debuggers; uses timestamp manipulation, file deletion, runtime unpacking, and direct or indirect system calls to complicate detection.
Payload Delivery: Delivers commodity malware, including RedLine Stealer, Raccoon Stealer, Amadey, SmokeLoader, Socelars, Glupteba, XMRig, and credential-recovery utilities, for credential theft, cryptocurrency mining, and botnet enrollment.
Persistence: Establishes long-term access via a fake csrss.exe process at C:\Windows\rss, a non-standard path outside the legitimate System32 location, along with registry entries, a scheduled task (Schedule.Service.1), VirtualBox-named services (VBoxGuest, VBoxMouse, VBoxSF, VBoxService, VBoxVideo, VBoxWddm) on non-virtualized hosts, and startup-item changes.
Command and Control: A cluster of at least 44 TimeWeb-hosted servers returns HTTP 301 redirects to GitHub on unsolicited requests, making C2 and proxy hosts appear as ordinary redirectors during cursory scans. Dropped processes reach two campaign-specific nodes, 212.193.30[.]29 and 212.193.30[.]45, via WinHTTP using a malformed User-Agent string that collapses to a single control byte (0x02) on the wire, a strong network detection artifact. GitHub itself is not compromised.
Post-Compromise: 212.193.30[.]29 serves the STANDOFF COORD operator console (backend at api.russianhackers[.]online); 212.193.30[.]45 serves proxies.txt for proxy-list distribution. STANDOFF COORD lets multiple operators coordinate targeted Active Directory intrusions, storing stolen NTLM hashes, Kerberos tickets, session cookies, and private keys, organized by network segment (internal, DMZ, external), with UI and knowledge-base content predominantly in Russian.
Influence and Outreach Layer: The same TimeWeb-hosted infrastructure (217.198.13[.]211) also runs a Telegram account-farming platform that automates account creation, warming, and orchestration through a Moscow-time scheduler, and a separate English-language, AI-driven multi-channel outreach platform integrating Gmail/IMAP, Google Sheets, an LLM (reported as Anthropic’s Claude), Telegram, and WhatsApp to generate content and automate mass outreach, backed by a credential vault for API keys and OAuth tokens.
Impact
Credential and Data Theft: Stealer components (RedLine, Raccoon, Socelars, credential-recovery utilities) harvest browser credentials, cryptocurrency-wallet data, and screenshots; STANDOFF COORD additionally stores NTLM hashes, Kerberos tickets, session cookies, and private keys.
Security Control Degradation: Disabling Defender and Windows Update extends attacker dwell time and blocks future remediation.
Resource Hijacking: XMRig allows unauthorized Monero mining to an attacker-controlled wallet, degrading performance; Glupteba-style components enroll hosts into a proxy botnet, turning endpoints into traffic relays.
Lateral Movement and Targeted Intrusion: STANDOFF COORD lets operators organize compromised hosts by network segment and coordinate hands-on-keyboard Active Directory intrusion beyond opportunistic infection.
Coordinated Inauthentic Engagement: The campaign’s Telegram account-farm and AI-driven outreach platform extend risk beyond technical compromise, providing automated, multi-channel infrastructure that could support further social-engineering, lure distribution, or influence activity.
Detection Evasion: The fake csrss.exe process, VirtualBox-named services, and extensive anti-analysis checks help the malware blend into normal activity and evade automated and manual investigation.
Detection Method
Defender Configuration Monitoring: Watch for unauthorized Defender changes, including disabled real-time monitoring, sample submission, MAPS reporting, or new exclusions, via Get-MpPreference and Get-MpComputerStatus.
Fake Process Detection: Flag csrss.exe instances running outside C:\Windows\System32, particularly from C:\Windows\rss.
Persistence Artifacts: Review scheduled tasks (particularly Schedule.Service.1), services, startup items, and Run-key entries for unrecognized additions.
Host Artifacts: Watch for VirtualBox-named services (VBoxGuest, VBoxMouse, VBoxSF, VBoxService, VBoxVideo, VBoxWddm) running on hosts that are not virtual machines, and for the staging path %LOCALAPPDATA%\7zSCB82E89C.
Staging Directory: Inspect %LOCALAPPDATA% for randomized-name folders containing approximately 40 to 50 recently created executables, including files matching the pattern MONXXXXXXXX.exe.
Process Chain Anomalies: Watch for hidden or unusual cmd.exe chains spawning multiple child processes.
Network Signature: Flag WinHTTP connections using a corrupted or malformed User-Agent string that collapses to a single control byte (0x02) on the wire, and outbound 301 redirects to github.com from unexpected internal hosts.
PowerShell Log Review: Check PowerShell operational logs for commands altering Defender settings or the Windows Update service.
IOC Correlation: Cross-reference outbound connections, domains, and file hashes against the indicators in Section 5.0.
Indicators of Compromise
File Hash
Type | Indicator | Description |
SHA-256 | 22ebb950592ccc987fd1dab9ddcd34c4fc519975dc1b82e4a793dc038d2d8e41 | Loader sample hash |
IP Addresses
Type | Indicator | Description |
IP Address | 212.193.30[.]29 | STANDOFF COORD operator console infrastructure |
IP Address | 212.193.30[.]45 | Proxy-list distribution / GitHub-redirect infrastructure |
IP Address | 217.198.13[.]211 | Mobile Arena lure portal, operator apps, and Telegram-farm host |
IP Address | 5.129.196[.]85 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.208[.]108 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.209[.]17 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.209[.]58 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.210[.]32 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.210[.]139 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.214[.]85 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.216[.]104 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.217[.]228 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.219[.]114 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.225[.]220 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.226[.]97 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.213[.]59 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.213[.]241 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.227[.]196 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.231[.]176 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.231[.]240 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.233[.]99 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.236[.]52 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.236[.]68 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.237[.]19 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.237[.]53 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.238[.]90 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.238[.]104 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.238[.]105 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.239[.]229 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 5.129.242[.]37 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 37.252.21[.]227 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 45.139.78[.]67 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 46.149.70[.]188 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 89.223.71[.]207 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 90.156.224[.]57 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 92.51.22[.]34 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 93.183.80[.]126 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 147.45.183[.]198 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 147.45.237[.]231 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 185.247.185[.]85 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 188.225.39[.]252 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 188.225.72[.]157 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 188.225.82[.]125 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 194.87.56[.]156 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 194.87.131[.]30 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 195.133.73[.]225 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 212.60.21[.]249 | GitHub-redirect concealment node (44-server cluster) |
IP Address | 104.247.81[.]99 | Amadey infrastructure |
IP Address | 212.192.241[.]62 | Amadey infrastructure |
IP Address | 185.215.113[.]35 | Amadey infrastructure |
IP Address | 188.40.141[.]211 | SmokeLoader infrastructure |
IP Address | 3.229.117[.]57 | Additional downloader infrastructure |
Domains, URLs, and C2 Endpoints
Type | Indicator | Description |
Domain | russianhackers[.]online | Campaign infrastructure domain |
Domain | api.russianhackers[.]online | Campaign infrastructure domain |
Domain | bull-drops[.]online | Campaign infrastructure domain |
Domain | bull-drops[.]ru | Campaign infrastructure domain |
Domain | bulldrops[.]online | Campaign infrastructure domain |
Domain | bulldrops[.]ru | Campaign infrastructure domain |
Domain | xn--90aguaqgfu[.]xn--p1ai | Campaign infrastructure domain |
Domain | ggstandoff[.]online | Campaign / gaming-lure infrastructure domain |
Domain | zadrot[.]gg | Campaign / gaming-lure infrastructure domain |
Domain | influencesite[.]ru | AI-driven outreach platform domain |
Domain | gginfluence.influencesite[.]ru | AI-driven outreach platform subdomain |
Domain | mobilearena[.]online | Mobile Arena gaming lure portal |
Domain | www.mobilearena[.]online | Mobile Arena gaming lure portal |
Domain | xn----9sbhgocsfmg4a1kfg[.]xn--p1ai | Campaign infrastructure domain |
Domain | www.xn----9sbhgocsfmg4a1kfg[.]xn--p1ai | Campaign infrastructure domain |
C2 Endpoint | 185.215.113[.]44:23759 | RedLine Stealer C2 |
Domain | www.wgqpw[.]com | Socelars C2 |
C2 Endpoint | pool.supportxmr[.]com:3333 | XMRig mining pool |
URL | wfsdragon[.]ru/api/setStats.php | Amadey loader panel |
URL | rcacademy[.]at/upload | SmokeLoader delivery infrastructure |
Domain | server5.trumops[.]com | Additional downloader infrastructure |
Domain | www.listincode[.]com | Additional downloader infrastructure |
Domain | listincode[.]com | Additional downloader infrastructure |
Domain | cloudjah[.]com | Additional downloader infrastructure |
C2 Endpoint | 65.108.69[.]168:16278 | Additional downloader infrastructure |
C2 Endpoint | 23.88.118[.]113:23817 | Additional downloader infrastructure |
URL | coffee-music-laptop.s3.pl-waw.scw[.]cloud/publisherinstaller | Pay-per-install hosting |
URL | hammajawa7dou.s3.nl-ams.scw[.]cloud/advertiserInstallerpowerOff.exe | Pay-per-install hosting |
URL | cdn.discordapp[.]com/attachments/915539163787460658/917347672489349130/m | Payload hosting location |
URL | iplogger[.]org/2ANpP6 | Victim-tracking reference |
URL | iplogger[.]org/143up7 | Victim-tracking reference |
URL | iplogger[.]org/1FRbw7 | Victim-tracking reference |
URL | iplogger[.]org/1FEbw7 | Victim-tracking reference |
Domain | all-mobile-pa1ments.com[.]mx | Decoy domain in payload configuration |
Domain | buyfootball.com[.]sg | Decoy domain in payload configuration |
Domain | buy-fantasy-gxmes.com[.]sg | Decoy domain in payload configuration |
Domain | new-androidapps[.]me | Decoy domain in payload configuration |
Domain | topniemannpickshop[.]cc | Decoy domain in payload configuration |
Cryptocurrency Wallet
Type | Indicator | Description |
Cryptocurrency Wallet | 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDi | Attacker-controlled Monero mining wallet |
Host and Persistence Artifacts
Type | Indicator | Description |
File Name | setupx86x64install.exe | Initial NSIS-based pay-per-install loader |
File Path | C:\\Windows\\rss\\csrss.exe | Fake csrss.exe persistence location (non-standard path) |
File Path | %LOCALAPPDATA%\\7zSCB82E89C | Loader staging directory |
File Name | MONXXXXXXXX.exe | Randomized dropped-payload naming pattern |
File Name | C.exe | Persistence / payload artifact |
File Name | RaptorMiner.exe | Persistence / payload artifact |
File Path | Driver.url | Persistence artifact |
File Path | %APPDATA%\\APPDATA.exe | Persistence artifact |
Scheduled Task | Schedule.Service.1 | Logon-triggered persistence task naming pattern |
Service Name | VBoxGuest | VirtualBox-named malicious persistence service |
Service Name | VBoxMouse | VirtualBox-named malicious persistence service |
Service Name | VBoxSF | VirtualBox-named malicious persistence service |
Service Name | VBoxService | VirtualBox-named malicious persistence service |
Service Name | VBoxVideo | VirtualBox-named malicious persistence service |
Service Name | VBoxWddm | VirtualBox-named malicious persistence service |
Network Port | TCP/31461 | Observed local listener port |
Network Port | TCP/49703 | Observed local listener port |
Mutex | Global\\48yorbq6rm87zot | Host-based malware artifact |
Mutex | Global\\9g8w kEecfMwgjiZ5i-O1fR-8gT0 | Host-based malware artifact |
Network Signature | Corrupted WinHTTP User-Agent (control byte 0x02 on the wire) | Distinctive network detection signal |
Recommendations
Rotate credentials on infected endpoints, prioritizing domain and privileged accounts if Active Directory exposure is suspected.
Deploy EDR capable of detecting Defender tampering and fake process creation; enable PowerShell script block logging.
Enforce application allowlisting to block unauthorized loader and payload execution.
Restrict and monitor outbound traffic for GitHub redirect anomalies and connections to the domains and IPs listed above.
Audit Defender exclusions and PowerShell execution policy regularly, and alert on unauthorized changes.
If STANDOFF artifacts or infrastructure are identified, initiate incident response and a full Active Directory forensic review given the campaign’s Kerberos and NTLM targeting.
Apply attack surface reduction rules to limit PowerShell abuse and syscall-based evasion.
Extend security awareness training to cover gaming-themed lures, such as free in-game skins or promo codes distributed through unofficial portals, given the campaign’s use of a fake gaming site as an infection vector.
Conclusion
Operation STANDOFF is an active, multi-layered campaign that combines commodity credential theft, cryptocurrency mining, and proxy-botnet activity with infrastructure built for targeted Active Directory intrusion, a gaming-themed lure portal, a Telegram account-farm, and an AI-driven outreach platform, all hosted on shared TimeWeb infrastructure. Its Defender-disabling PowerShell commands, fake csrss.exe persistence, and GitHub-redirect concealment extend dwell time on compromised systems. Organizations should audit Defender configurations, hunt for the fake csrss.exe artifact and listed IOCs, and treat any confirmed compromise as a possible precursor to targeted intrusion.
References
https://www.vmray.com/execution-level-analysis-of-a-russian-speaking-multi-operator-intrusion-campaign-operation-standoff/
https://cyberpress.org/operation-standoff-deploys-fake-csrss/
https://cybersecuritynews.com/standoff-hides-traffic/
https://gbhackers.com/operation-standoff-uses-github/
https://windowsnews.ai/article/the-fake-csrssexe-hiding-in-plain-sight-how-operation-standoff-is-compromising-windows-pcs.440718