LockAppHost Abuses CMSTP to Disable Five Windows Update Services and Eleven Tasks Before Miner Deployment

The four modules share REVSTEALER's packer, runtime resolution, and Polygon contract config retrieval, yet Elastic recovered them only from the same investigation rather than live handoff. This leaves open whether they represent post-exfiltration tooling sold separately or an incomplete delivery chain. ProManager overlays Electron wallet windows to capture passphrases while WinUpdate performs clipboard address swaps, patterns previously seen in separate clipboard miners but now unified under one tradecraft set.

Shared build artifacts across the activity set point to a single developer group maintaining a modular post-stealer toolkit rather than opportunistic reuse. The absence of observed delivery suggests the modules may require separate loader or C2 commands not yet captured. LockAppHost's persistence via Registry Run or service, combined with its defense weakening, creates durable footholds that survive standard remediation focused on the initial stealer.

Procurement records and job postings for similar commercial stealers show increasing emphasis on secondary monetization stages after credential harvest. Independent samples on VirusTotal from February 2026 onward confirm ongoing distribution but lack the module payloads, indicating the campaign remains narrowly targeted. Defenders should monitor CMSTP invocations followed by service stops rather than relying solely on stealer IOCs.

Next steps include expanded YARA coverage for the shared packer and behavioral rules around update service tampering. Elastic's findings align with prior reports of infostealers evolving into multi-stage operations, yet the precise linkage to REVSTEALER C2 remains unconfirmed in telemetry.