Backdoor delivered through software updates

This malware campaign involves a backdoor delivered through compromised automatic software updates of Download Studio and three adblockers. The backdoor creates a fake Malwarebytes installation directory containing legitimate signed files alongside malicious DLLs to evade detection. Once executed, it establishes persistence via a Windows service and communicates with command-and-control servers to receive configuration updates and additional payloads. The infrastructure supports multiple persistent threats, with cryptocurrency miners being the primary observed payload. The attack demonstrates abuse of software update mechanisms and supply chain compromise techniques, targeting primarily users in Russia, Ukraine, and Kazakhstan.

The backdoor enables attackers to maintain persistent access on infected machines and remotely deliver additional malicious payloads, primarily cryptocurrency miners. This results in unauthorized resource consumption and potential further compromise. The infection affects over 100,000 machines, primarily in Russia, Ukraine, and Kazakhstan. The compromised software update mechanism undermines trust in legitimate software updates and can facilitate widespread malware distribution.

No official patch or remediation guidance is provided in the available data. Since this is a supply chain compromise abusing software update mechanisms, users should verify the integrity of software updates and consider reinstalling affected applications from trusted sources. Monitoring for indicators of compromise such as the listed malicious domains and hashes may help detect infection. Vendors of the affected software should investigate and secure their update infrastructure. Patch status is not yet confirmed — check vendor advisories for updates.