eScan Antivirus Update Mechanism Exploited to Spread Backdoors and Miners

Avast reported a long-running GuptiMiner campaign exploiting an insecure eScan update mechanism (unsigned, non-HTTPS downloads) to sideload a malicious DLL (updll62.dlz -> version.dll) that implements a multi-stage loader: DNS-based C2 resolution, PNG files with appended shellcode, gzip-decompressed payloads, and a final Puppeteer backdoor that deploys XMRig miners and modular backdoors capable of lateral movement and credential/crypto-wallet theft; telemetry and artifact uploads date activity back to 2018 and researchers note overlaps with tools linked to the North Korean group Kimsuky.