MicroWorld Technologies

Summary

Hackers gained unauthorized access to the update infrastructure of the antivirus product eScan, which is developed by MicroWorld Technologies, and used it to distribute a malicious Reload.exe file that initiated a multi‑stage infection chain. The file altered the HOSTS file to block legitimate updates, created persistence mechanisms, and downloaded additional payloads, leaving affected systems unable to receive automatic remediation. Security researchers detected the activity and notified the vendor, which confirmed the breach, isolated the compromised servers, and later provided a cleanup tool to restore normal functionality and remove the infection. The vendor expressed disagreement with the researchers’ characterization of the event as a supply‑chain attack.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 20, 2026, eScan detected unauthorized access to its update infrastructure and immediately isolated the affected servers, which remained offline for over eight hours. The following day, January 21, cybersecurity firm Morphisec reported the incident to MicroWorld Technologies after detecting malicious behavior on its customers’ devices. Morphisec’s threat bulletin, published on January 29, described how rogue updates were distributed through eScan’s legitimate update infrastructure, delivering a multi-stage malware payload. The malicious update included a file named Reload.exe that modified the HOSTS file to block automatic updates, created scheduled tasks for persistence, and downloaded additional payloads to compromised systems.

As a result of the malicious update, affected enterprise and consumer endpoints experienced altered antivirus functionality and were cut off from receiving further eScan updates, making automatic remediation impossible. eScan advised impacted organizations and individuals to contact its technical support team to obtain a manual cleanup utility designed to remove the infection, roll back system modifications, and restore normal antivirus operation. In a security advisory issued on January 22, eScan disclosed that the unauthorized access had affected a regional update server and that an incorrect patch configuration binary had been placed in the update distribution path during a limited timeframe on January 20. The advisory noted that the incident had a medium‑high impact on enterprise customers, a assessment that aligned with Morphisec’s findings.

Despite confirming the unauthorized access, eScan expressed dissatisfaction with Morphisec’s characterization of the event as a supply chain attack and disputed the accuracy of the firm’s reporting. The company indicated that it was working with legal counsel regarding the matter. SecurityWeek attempted to obtain a statement from eScan but had not received a response at the time of publication.

Sources

Sources available to members: 1 source.