eScan Antivirus Update Server Breached to Deliver Malicious Software Updates

MicroWorld Technologies’ eScan antivirus platform fell victim to a sophisticated supply chain attack on January 20, 2026, when threat actors compromised legitimate update infrastructure to distribute multi-stage malware to enterprise and consumer endpoints worldwide.

Security researchers immediately alerted the vendor, which isolated the affected infrastructure within one hour and took its global update system offline for over eight hours.

However, the attack’s critical nature where malicious payloads deliberately disable eScan’s functionality and block automatic updates means thousands of users cannot remediate through standard patching processes and must contact eScan directly for manual intervention.

Attack Methodology and Payload Chain

According to Morphisec, the compromise deployed a three-stage attack architecture designed for persistence and defense evasion.

The initial trojanized eScan component replaces Reload.exe with malicious code that drops CONSCTLX.exe, a 64-bit persistent downloader capable of executing arbitrary PowerShell commands and maintaining command-and-control communications.

The second stage establishes persistence through scheduled tasks disguised within WindowsDefrag directories using naming patterns like “CorelDefrag,” while simultaneously tampering with hosts files and eScan registry settings to prevent legitimate updates and block security communications.

The attack’s sophistication lies in its anti-remediation capabilities. By deliberately corrupting eScan’s update mechanism and registry configurations, threat actors ensured that standard automatic patching would fail, forcing organizations into reactive manual remediation workflows.

This strategic design choice significantly extends the attack window and increases the likelihood of successful lateral movement or secondary payload deployment before remediation occurs.

Organizations must immediately search for the primary trojanized Reload.exe file using SHA-256 hash 36ef2ec9ada035c56644f677dab65946798575e1d8b14f1365f22d7c68269860, supplemented by scanning for two additional related samples observed on VirusTotal.

Detection teams should prioritize registry searches for suspicious GUID-named keys under HKLMSoftware containing encoded byte array data, review WindowsDefrag scheduled tasks for unexpected entries, and inspect hosts files for entries blocking eScan update infrastructure.

Network security teams must block identified C2 domains including vhs.delrosal.net, tumama.hns.to, blackice.sol-domain.org, and codegiant.io, along with IP 185.241.208.115.

eScan released patches to restore functionality, but affected systems require manual intervention before standard updates can reinstall.

Indicators of Compromise (IOCs) – eScan Supply Chain Attack

Stage 1: Trojanized eScan Component

Stage 2: Command & Control Infrastructure

Stage 3: Persistent Downloader

Persistence Mechanisms

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.