CampaignPublished 29 Jan 2026

eScan confirms update server breached to push malicious update

Source AlienVault OTX General

Description

MicroWorld Technologies has confirmed that one of its update servers was breached and used to distribute a malicious update to some customers in the early hours of January 2026, reports BleepingComputer.

Impact

For European organizations, this supply chain compromise could lead to unauthorized access, data exfiltration, or system manipulation if the malicious update is installed. Organizations relying on eScan antivirus products, particularly those with automatic update mechanisms enabled, face increased risk of stealthy backdoor implantation. This could undermine endpoint security, allowing attackers to bypass traditional defenses and persist undetected. Critical sectors such as finance, healthcare, and government agencies could suffer operational disruptions or data breaches. The incident may also erode trust in software supply chains and antivirus vendors, prompting regulatory scrutiny under GDPR and NIS2 directives. Additionally, the presence of malicious domains and URLs associated with the attack infrastructure could facilitate further lateral movement or command and control activities within affected networks. The medium severity rating suggests limited current exploitation but warns of potential escalation if attackers leverage the foothold for broader campaigns.

Defensive guidance

European organizations should immediately verify the integrity and authenticity of eScan updates by comparing cryptographic hashes against vendor-provided values or using out-of-band verification methods. Disable automatic updates temporarily until the vendor confirms the update server's security and releases clean updates. Implement network monitoring and DNS filtering to block communications with identified malicious domains such as 504e1a42.host.njalla.net, blackice.sol-domain.org, and vhs.delrosal.net. Conduct endpoint scans for indicators of compromise related to the malicious update, focusing on unusual middleware components or backdoor signatures. Enhance supply chain security by adopting multi-factor authentication and strict access controls on update infrastructure. Employ application allowlisting to prevent unauthorized code execution. Collaborate with MicroWorld Technologies for timely patches and threat intelligence sharing. Finally, review and update incident response plans to address supply chain attack scenarios and conduct user awareness training on the risks of compromised software updates.

Indicators of compromise

Domains 3

504e1a42.host.njalla.net
blackice.sol-domain.org
vhs.delrosal.net

URLs 2

http://codegiant.io/dd/dd/dd.git/download/main/middleware.ts
http://vhs.delrosal.net/i

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Jan 2026, 21:27 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

Indicators of compromise

Domains 3

URLs 2

Community reviews

Related threats