Hackers hijack antivirus updates to drop GuptiMiner malware

Avast researchers found that North Korean-linked actors hijacked eScan antivirus update packages to distribute GuptiMiner — a sophisticated payload that sideloads a malicious DLL, fetches additional modules, disables security products, persists via scheduled tasks and registry entries, extracts payloads from images, and deploys backdoors and an XMRig miner; Avast released IoCs and eScan patched the update mechanism but infections persist, possibly from outdated clients.