GuptiMiner: Hijacking Antivirus Updates for Distributing Backdoors and Casual Mining

FanJ · Apr 23, 2024

Avast - April 23, 2024
https://decoded.avast.io/janrubin/g...for-distributing-backdoors-and-casual-mining/

Key Points

Avast discovered and analyzed a malware campaign hijacking an eScan antivirus update mechanism to distribute backdoors and coinminers
Avast disclosed the vulnerability to both eScan antivirus and India CERT. On 2023-07-31, eScan confirmed that the issue was fixed and successfully resolved
The campaign was orchestrated by a threat actor with possible ties to Kimsuky
Two different types of backdoors have been discovered, targeting large corporate networks
The final payload distributed by GuptiMiner was also XMRig
Click to expand...

We’ve been tracking a curious one here. Firstly, GuptiMiner is a highly sophisticated threat that uses an interesting infection chain along with a couple of techniques that include performing DNS requests to the attacker’s DNS servers, performing sideloading, extracting payloads from innocent-looking images, signing its payloads with a custom trusted root anchor certification authority, among others.
Click to expand...

The actors behind GuptiMiner have been capitalizing on an insecurity within an update mechanism of Indian antivirus vendor eScan to distribute the malware by performing a man-in-the-middle attack. We disclosed this security vulnerability to both eScan and the India CERT and received confirmation on 2023-07-31 from eScan that the issue was fixed and successfully resolved.
Click to expand...

Long article; read there more.

Rasheed187 · Apr 28, 2024

Wow, very sneaky and sophisticated attack. But clearly the MitM was done by some malware that was already running on the system, which means that eScan wasn't able to spot this malware. So that's why you should always deploy a seperate behavior blocker/EDR that augments the AV. On the other hand, eScan would be a trusted process, so this means that you should deploy a zero trust behavior blocker, I don't know if this exists at the moment.

Log in or Sign up

GuptiMiner: Hijacking Antivirus Updates for Distributing Backdoors and Casual Mining

FanJ Updates Team

Rasheed187 Registered Member

Log in or Sign up

GuptiMiner: Hijacking Antivirus Updates for Distributing Backdoors and Casual Mining

FanJ Updates Team

Rasheed187 Registered Member

Useful Searches