← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Supply chain attack on eScan antivirus: detecting and remediating malicious updates
On January 20, a significant supply chain attack impacted eScan antivirus, a product by MicroWorld Technologies. The attackers compromised one of the regional update servers and distributed a malicious file named Reload.exe to users of the antivirus software. This malware initiated a multi-stage infection process and effectively crippled the antivirus's ability to receive subsequent updates by altering the HOSTS file. This action blocked legitimate update communications, leading to errors in the update service.
Investigations into the attack revealed that the malicious Reload.exe file was not inserted due to a vulnerability in the software itself but rather through unauthorized access to the update infrastructure. The attackers deployed this malware under the guise of a fake invalid digital signature, which facilitated its acceptance as a legitimate update by unsuspecting users.
Indicators of Compromise (28)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| URL | https://blackice.sol-domain.org | — | 2026-01-30 | |
| URL | https://codegiant.io/dd/dd/dd.git/download/main/middleware.ts | — | 2026-01-30 | |
| URL | https://csc.biologii.net/sooc | — | 2026-01-30 | |
| URL | https://vhs.delrosal.net/i | — | 2026-01-30 | |
| domain | codegiant.io | — | 2026-01-30 | |
| hostname | blackice.sol-domain.org | — | 2026-01-30 | |
| hostname | csc.biologii.net | — | 2026-01-30 | |
| hostname | vhs.delrosal.net | — | 2026-01-30 | |
| hostname | airanks.hns.to | — | 2026-01-30 | |
| hostname | tumama.hns.to | — | 2026-01-30 | |
| FileHash-MD5 | 8c96e393be264bce1789a93b59cb6853 | MD5 of bec369597633eac7cc27a698288e4ae8d12bdd9b01946e73a28e1423b17252b1 | 2026-01-30 | |
| FileHash-SHA1 | 2d2d58700a40642e189f3f1ccea41337486947f5 | SHA1 of bec369597633eac7cc27a698288e4ae8d12bdd9b01946e73a28e1423b17252b1 | 2026-01-30 | |
| FileHash-SHA256 | bec369597633eac7cc27a698288e4ae8d12bdd9b01946e73a28e1423b17252b1 | — | 2026-01-30 | |
| URL | http://codegiant.io/dd/dd/dd.git/download/main/middleware.ts | — | 2026-01-30 | |
| URL | http://vhs.delrosal.net/i | — | 2026-01-30 | |
| domain | codegiant.io | — | 2026-01-30 | |
| hostname | 504e1a42.host.njalla.net | — | 2026-01-30 | |
| hostname | blackice.sol-domain.org | — | 2026-01-30 | |
| hostname | vhs.delrosal.net | — | 2026-01-30 | |
| FileHash-MD5 | 350b82fa70888eee712fb08fed90a14d | MD5 of 386a16926aff225abc31f73e8e040ac0c53fb093e7daf3fbd6903c157d88958c | 2026-01-30 | |
| FileHash-MD5 | b6373e6f0e6dcd2fbe8cb437a3130ac1 | MD5 of 674943387cc7e0fd18d0d6278e6e4f7a0f3059ee6ef94e0976fae6954ffd40dd | 2026-01-30 | |
| FileHash-SHA1 | 1617949c0c9daa2d2a5a80f1028aeb95ce1c0dee | SHA1 of 386a16926aff225abc31f73e8e040ac0c53fb093e7daf3fbd6903c157d88958c | 2026-01-30 | |
| FileHash-SHA1 | a928bddfaa536c11c28c8d2c5d16e27cbeaf6357 | SHA1 of 674943387cc7e0fd18d0d6278e6e4f7a0f3059ee6ef94e0976fae6954ffd40dd | 2026-01-30 | |
| FileHash-SHA256 | 386a16926aff225abc31f73e8e040ac0c53fb093e7daf3fbd6903c157d88958c | — | 2026-01-30 | |
| FileHash-SHA256 | 674943387cc7e0fd18d0d6278e6e4f7a0f3059ee6ef94e0976fae6954ffd40dd | — | 2026-01-30 | |
| FileHash-MD5 | d7cfa6b8e51dea972107a92eedc1cbf0 | MD5 of 36ef2ec9ada035c56644f677dab65946798575e1d8b14f1365f22d7c68269860 | 2026-01-30 | |
| FileHash-SHA1 | ebaf9715d7f34a77a6e1fd455fe0702274958e20 | SHA1 of 36ef2ec9ada035c56644f677dab65946798575e1d8b14f1365f22d7c68269860 | 2026-01-30 | |
| FileHash-SHA256 | 36ef2ec9ada035c56644f677dab65946798575e1d8b14f1365f22d7c68269860 | — | 2026-01-30 |