eScan antivirus Archives

eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware

2Feb

By RBNo Comments

News

eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware

Unknown attackers have gained access to the update infrastructure for eScan antivirus, a security product created by Indian cybersecurity firm MicroWorld Technologies, in order to distribute a persistent downloader to consumer and business systems. According to Morphisec researcher Michael Gorelik, malicious updates were sent using eScan's authorized update infrastructure, causing multi-stage malware to spread to consumer and enterprise endpoints worldwide. According to MicroWorld Technologies, it quickly isolated the affected update servers after discovering unauthorized access to its infrastructure, which kept them offline for more than eight hours. It has also released a patch that reverts the changes introduced as part of the malicious update. To get the remedy, affected firms a...

eScan Antivirus Update Mechanism Exploited to Spread Backdoors and Miners

Via a persistent threat nicknamed GuptiMiner that targets major corporate networks, a new malware campaign has been distributing backdoors and cryptocurrency miners like XMRig by taking advantage of the update mechanism of the eScan antivirus program. The action, according to cybersecurity company Avast, is the product of a threat actor who may have ties to the Kimsuky hacker gang, also known as Black Banshee, Emerald Sleet, and TA427. Kimsuky is a North Korean hacking group. Avast stated that GuptiMiner is a highly sophisticated threat that employs a couple of techniques, including sideloading, extracting payloads from seemingly innocent images, signing its payloads with a custom trusted root anchor certification authority, and making DNS requests to the attacker's DNS servers. ...

Hackers hijack antivirus updates to drop GuptiMiner malware

Using the eScan antivirus's update system, North Korean hackers have been able to install backdoors on large corporate networks and distribute the GuptiMiner malware, which is used to mine cryptocurrencies. GuptiMiner is referred regarded by researchers as "a highly sophisticated threat" because it has the ability to sign its payloads, extract payloads from pictures, execute DLL sideloading, and send DNS requests to the attacker's DNS servers. The threat actor behind GuptiMiner allegedly used an adversary-in-the-middle (AitM) position to take control of a legitimate virus definition update package and replace it with a malicious one called "updll62.dlz," according to a study published today by cybersecurity firm Avast. In addition to the required antivirus updates, the malicious ...