Security researchers have exposed a sprawling malware campaign that plants a counterfeit version of a critical Windows system process to slip past antivirus defenses, steal credentials, mine cryptocurrency, and recruit infected machines into a proxy botnet. Dubbed Operation STANDOFF, the attack chain relies on a loader that drops multiple well-known malware families while disabling Microsoft Defender and Windows Update, leaving victims exposed to further exploitation.

What Operation STANDOFF actually does

The campaign’s first stage is a 32‑bit NSIS installer named setupx86x64install.exe, which acts as a distribution hub rather than a single-purpose threat. Once executed, it creates approximately 40 to 50 executable files inside a randomly named folder under %LOCALAPPDATA%, then launches them through repeated hidden cmd.exe processes, according to analysis from VMRay cited by Cyber Press.

Among the payloads are commodity malware tools including RedLine Stealer, Raccoon Stealer, Amadey, SmokeLoader, Socelars, Glupteba, XMRig, and various credential-recovery utilities. This mix gives attackers several monetization options at once: steal browser passwords and cryptocurrency wallets, mine Monero, enroll the machine as a proxy relay, or use the foothold for later hands‑on intrusion.

The fake csrss.exe that hides in an unexpected folder

The most deceptive persistence mechanism is a malicious executable named csrss.exe placed in C:\Windows\rss\csrss.exe – outside the legitimate System32 or SysWOW64 directories where the real Client Server Runtime Process lives. The malware registers it as a Windows service using names that resemble VirtualBox components, ensuring it starts automatically.

From a distance, the filename looks trustworthy. Help desk staff and users are trained not to terminate processes like csrss.exe, winlogon.exe, or lsass.exe. But the image path tells a different story: no authentic Windows component resides in C:\\Windows\\rss. Cyber Press reports that the fake service and the unusual folder location have been observed in earlier Glupteba infections, making the tactic a known tradecraft rather than a benign anomaly.

Disabling Defender and Windows Update opens the door

PowerShell commands run by the loader go after Microsoft Defender aggressively. Real‑time monitoring gets turned off, automatic sample submission is blocked, MAPS cloud reporting is cut, and the malware’s staging folder is added to Defender’s exclusion list. The campaign also probes for third‑party security products from Avast, AVG, Bitdefender, ESET, Kaspersky, Norton, Panda, and Sophos.

Microsoft warns that custom exclusions override built‑in and automatic exclusions, so adding a seemingly obscure path like a %LOCALAPPDATA% subdirectory can create a reliable blind spot. The attackers do not need to permanently remove Defender; a well‑crafted exclusion is often enough.

Compounding the risk, the operation tries to stop or delete the Windows Update service. This can freeze security intelligence updates and Windows patches, deliberately keeping the system in a degraded state where detection is less likely.

From commodity malware to corporate intrusion

What elevates Operation STANDOFF above an ordinary bundle is a reported platform called STANDOFF COORD. Described as a multi‑operator web interface, it inventories targets, tracks agent check‑ins, stores credentials, and organizes information by network zone – internal, DMZ, or external. The platform holds passwords, NTLM hashes, Kerberos tickets, API tokens, cookies, and private keys.

This suggests the operation can pivot from automated theft to hands‑on corporate compromise. A single infected workstation might yield stored enterprise credentials, cloud session cookies, VPN logins, or domain‑admin hashes, all cataloged for later exploitation.

What this means for you

For home users, the immediate impact may feel like a suddenly sluggish PC because of crypto mining, accompanied by unexplained pop‑ups or browser behavior. But the real damage runs deeper: passwords saved in Chrome, Edge, or Firefox can be exfiltrated, cryptocurrency wallets emptied, and your internet connection hijacked for proxy botnet traffic – which can get your IP address flagged for malicious activity.

For business and IT admins, the threat escalates quickly. A compromised endpoint that appears to be just another malware incident could be the entry point for a broader intrusion. Saved administrative credentials, remote desktop shortcuts, and cloud‑service tokens are gold for an attacker who has already cataloged your internal, DMZ, and external segments. Moreover, a machine added to a proxy botnet can cause reputational harm and complicate network forensic investigations.

The fake csrss.exe particularly endangers environments where incident response relies heavily on process names. A busy IT team might overlook an executable called csrss.exe if it is not immediately causing performance issues. This is exactly the gap the attackers exploit.

How we got here: the return of a proven masquerade

Malware authors have long understood that Windows users trust process names they see in Task Manager. The real csrss.exe is essential for console windows and threading, and it runs from C:\\Windows\\System32. By placing a doppelgänger in C:\\Windows\\rss, attackers borrow that trust while remaining easy to miss unless someone checks the full path.

This isn’t a new trick. Security firm K7 Labs documented Glupteba using the same C:\\Windows\\rss\\csrss.exe location back in 2021, complete with Defender exclusion abuse. Operation STANDOFF modernizes the approach by combining it with a pay‑per‑install loader that drops a smorgasbord of commodity malware, then ties everything to a centralized intrusion platform.

Infrastructure details add a layer of camouflage. Researchers observed HTTP 301 redirects pointing to github.com on many attacker‑controlled servers. GitHub itself is not compromised – the redirect makes the infrastructure appear benign during automated scans. An analyst who sees only the final 302 to a trusted domain might dismiss the traffic, missing the malicious source server.

What to do now: practical steps for Windows users and admins

1. Verify that no rogue csrss.exe is running

Open Task Manager, switch to the Details tab, right‑click the column header, choose Select columns, and add Image Path Name. Look for any csrss.exe located outside C:\\Windows\\System32 or C:\\Windows\\SysWOW64. Pay special attention to C:\\Windows\\rss. Right‑click the process and choose Open file location to confirm. If you find a suspicious copy, isolate the machine from the network immediately.

2. Audit Microsoft Defender settings and exclusions

Run PowerShell as Administrator and use the following commands:

Get-MpPreference | Select-Object DisableRealtimeMonitoring, SubmitSamplesConsent, MAPSReporting, ExclusionPath, ExclusionProcess

Check for any unexpected paths, especially those that match a randomly named folder under %LOCALAPPDATA% or C:\\Windows. If tamper protection is off, enable it:

Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -SubmitSamplesConsent 1   # Always prompt or 3 for automatic
Set-MpPreference -MAPSReporting 2          # Advanced membership

Review the full list of exclusions and remove any that you did not intentionally configure.

3. Inspect Windows services and scheduled tasks

Press Win+R, type services.msc, and scan for services with names that mimic virtualization tools (like “VirtualBox”) or appear as random strings. Check the Path to executable column. Similarly, open Task Scheduler and disable or delete any task that references C:\\Windows\\rss or an unknown executable in %LOCALAPPDATA%.

4. Confirm Windows Update is functional

Go to Settings > Windows Update and check the update history. If the service is missing or stuck, open services.msc, locate Windows Update, and ensure its startup type is set to Manual or Automatic (Trigger Start). Run wuauclt /detectnow from an admin command prompt to force a detection cycle.

5. Look for suspicious network requests

Search firewall logs, proxy logs, or EDR telemetry for outbound connections to IP addresses associated with the campaign – notably 212.193.30.29 and 212.193.30.45 which served server.txt and proxies.txt in sandbox analysis. Also hunt for HTTP requests that receive a 301 redirect to github.com from non‑standard sources. Keep in mind that legitimate systems contact GitHub, so correlate with process ancestry and file‑creation events.

6. Assume credentials were stolen if infection is confirmed

If any of the campaign’s stealer payloads executed, reset every password that was stored in browsers or password managers on the affected device. Revoke active sessions for cloud services, rotate API keys, and check identity‑provider logs for unusual logins. In corporate environments, trigger a forced password reset for the affected user and review privileged account activity.

7. Strengthen prevention going forward

  • Enable tamper protection in Windows Security to block local tampering with Defender settings.
  • Turn on cloud‑delivered protection and automatic sample submission to benefit from Microsoft’s latest intelligence.
  • Deploy attack surface reduction (ASR) rules in audit mode first, then switch to block mode after testing. Microsoft particularly recommends rules that block credential stealing from the LSASS process and restrict execution of potentially obfuscated scripts.
  • Enforce PowerShell logging and consider Constrained Language Mode.
  • Use application control (AppLocker or Windows Defender Application Control) to limit what installers can run.
  • Ensure users operate without local administrator privileges whenever possible.

Outlook: a blueprint for future campaigns

Operation STANDOFF demonstrates that a well‑orchestrated malware operation doesn’t need zero‑days – it just needs to chain together commodity tools with a few effective evasion tricks. The fake csrss.exe in a non‑standard Windows folder, combined with aggressive Defender tampering and a centralized intrusion platform, turns a routine loader into a Swiss Army knife for criminal profit.

For Windows users, the takeaway is clear: a clean filename is not a guarantee of safety. Defenders must look at the full image path, process ancestry, and configuration changes. Expect imitators to refine the same playbook, making behavioral detection and endpoint telemetry more critical than ever.