North Korean Hackers Hijack Antivirus Updates

In this video I talk about the GuptiMiner Malware campaign that's been targeting users of the escan antivirus program. Read more about Gutiminer here
decoded.avast.io/janrubin/gup...
My merch is available at
based.win/
Subscribe to me on Odysee.com
odysee.com/@AlphaNerd:8
₿💰💵💲Help Support the Channel by Donating Crypto💲💵💰₿
Monero
45F2bNHVcRzXVBsvZ5giyvKGAgm6LFhMsjUUVPTEtdgJJ5SNyxzSNUmFSBR5qCCWLpjiUjYMkmZoX9b3cChNjvxR7kvh436
Bitcoin
3MMKHXPQrGHEsmdHaAGD59FWhKFGeUsAxV
Ethereum
0xeA4DA3F9BAb091Eb86921CA6E41712438f4E5079
Litecoin
MBfrxLJMuw26hbVi2MjCVDFkkExz8rYvUF

[@crazysnipercatt0]

If you're actually using eScan, then you getting hacked is just natural selection

[@ozziedegens]

why cap in ur rap

[@konstidee]

It's just quality control.

[@camwha5904]

I thought he said “eScam” lol

[@coolm98]

tbh this applies to pretty much anyone who solely relies on a third party to make up for users own stupidity...

[@Communist-Doge]

The moment he said "Indian" I knew what to expect.

[@toquita3D]

Once again, TempleOS is completely unaffected.

[@debianlasmana8794]

unfaze

[@GFunkEra1992]

If you want the virus deleted you need to buy 5 amazon gift cards of 200$ each

[@emmettturner9452]

Done. Where should I send the codes? Hurry! My computer is making noises and I’m sure it’s the virus. Halp!

[@ultimatums1]

$200*

[@XerrolAvengerII]

​@@ultimatums1 no that's part of the joke

[@ultimatums1]

@@XerrolAvengerII ah my bad

[@Octaviu5]

DO NOT REDEEM IT!!!

[@eamonnprunty]

April 2024 = hell month for CyberSec

[@w__a__l__e]

so the saying goes april showers bring may flowers.. wtf kinda "flower" are there going to be..

[@emmettturner9452]

@@w__a__l__eFeds dumping all their 0days to get us patched up since they lost them all to China and North K., who they are warning is “poised” for some big cyber attack. It takes a few weeks to come up with cover stories for leaking each exploit to the public.

[@vinci522]

Not if you sell CyberSec stuff. Fear is at its highest, customers are ready to drop those green stacks.

[@JJFX-]

​@@vinci522Yup then people start installing all the sketchy security apps and the circle of life continues.

[@BillAnt]

Ackchully (lol), just saw a video about the sudden large number of exploits and vulns, but in reality not much has increased except reporting. Better detection and more reporting, dass woots up.

[@kongstrong88]

Sirs... its over

[@Communist-Doge]

SAAR DO NOT REDEEM

[@BillAnt]

@@Mr.Equinox - Never heard of humor?! smh

[@dylanleaks1542]

@@Mr.Equinoxshut up

[@Octaviu5]

@@Mr.Equinox Lurk moar bundle of sticks

[@Moe_Posting_Chad]

@@Mr.Equinox Good morning sirs

[@sarundayo]

eScan? More like "eScam"

[@Communist-Doge]

India. 😂

[@Man-xk9rz]

Exactly lol. Wouldn't trust that AV.

[@iSaidNo666]

Great job boomer! This is absolutely freaking hilarious 😂😂😂😂😂😂😂😂💯

[@repliqa__]

If you're background was in tech I assume you would know anything can be broken in to. But yeah, don't get AVs no one has ever heard of. You don't even need AV if you're not a dummy.

[@RadicalAntifa]

​@@Communist-Dogespit Brit 😂

[@legitimatepsychiatricemerg1363]

NK did the needful

[@pittuk6500]

But did they revert kindly?

[@originallynot]

Saaaaar you need to install the update sar, don't redeem the code please sar

[@ultimatums1]

@@pittuk6500 upgradation

[@nothinghere9047]

NK made them open bob and vagene

[@Octaviu5]

Your stomach hurts, you need to poo. But I won’t let you near the loo! Begone from here, young Poojeet. To the designated shitting street!

[@bigsyrup8567]

SAHR, DO NOT REDEEM THE CRYPTO SAHR SAHR DO NOT

[@stephenkolostyak4087]

you forgot.... *ahem* NOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO

[@ahmedp8009]

BTCH! WHY DID YOU REDEEEEM?! DO NOT REDEEM MAAA'AAAM!

[@eggshapedisraelioperative6317]

maaam Maaam MAAAAAAAM!!

[@RadicalAntifa]

Freaking Islamist pedo

[@RadicalAntifa]

Amerishit trying to be funny lmao

[@jakealcock775]

Remember, it’s only an “attack” if it’s not done by an employee of FANG or our government, then it’s an “approach”

[@hakanbrakankrakan]

Imagine if MSM wrote about US spooks and expropriation the same way, "oppressive American regime steals property of innocent civilians!"

[@naoufal450]

Brother Kim Jong really seems to like your Monero XMR videos

[@Ultrajamz]

They redeemed

[@martin22336]

Escan. Escam ^ Indian antivirus.

[@tantalus1210]

no inb4 for me!

[@QP9237]

"We feel by scamming our clients we are actually counterintuitively protecting them, besides what thief would want to steal from a house that's already been broken into! Dumbasses am I right"

[@martin22336]

@@QP9237 Indian corruption, outweighs US corruption that even the scammers have competitive scammers.

[@QP9237]

@@martin22336 without a doubt, I would love to see the "scamming wars" where companies have proxy fights with call centers to take each other down lol

[@iamwitchergeraltofrivia9670]

Indian antivirus are the best

[@MushookieMan]

So unplugging your computer would actually work for once?

[@JJFX-]

Well you don't have to resort to caveman tactics but sure. All the 12yo gamers following memory overclocking guides for their 14900K probably have a graveyard of decapitated zombie malware sprinkled across their systems.

[@RochaPartneristDeadFireHD]

​@@JJFX- I like my malware because it makes my PC run hot, and as a result, my room feels cozy.

[@incognitoflamingo]

After working within critical infrastructure, which is really just a bunch of private companies that when you combine them together keeps the US running. Like food manufacturing, shit you would never think of like weighted relief valves and air pressure. But anyways, you get these engineers who are now in their 50s or 60s and running their business and they haven't updated anything within their infrastructure for years. I mean one place they had filemakerpro as their main software running on a cracked version of it since 2015. Windows 7. Computers that were never shut down. Running 24/7 it was kind of insane seeing it. And that's the majority of these companies. Boomers who don't understand VMs. Or use Excel to store every crucial password

[@Moe_Posting_Chad]

I worked for one of the largest payment processors and payment gateways in North America. I worked on legacy products. I shit you not, our in office IT team REFUSED *MULTIPLE FUCKING TIMES* to allow us to use a password manager. We also had like 30 different logins for various fucking what the hell does this do tool. Needless to say I moved on. It is fucking insane to ask me to reset passwords monthly, its sadistic to make me use unique passwords every time, no repeats ever, and its all on an excel I mean GOOGLE DOXX page. I'm telling you dude. It won't be many more mornings before a million Americans wake up to an empty bank account. Something is gonna fucking give and it just might be all of it all at once.

[@apIthletIcc]

Even as a independent researcher, the amount of this stuff I can figure out from public information is scary tbh and part of why I keep doing it. (Disclaimer: 'it' here means ethical work only) There's far too many people still at those business that were the smartest in the room 30 years ago still at the helm that in reality are actually complete idiots in modern scenarios.

[@thefadebeta580]

@@apIthletIcc I have seen an out of service Bank ATM screen that had Windows XP running , Fucking xp lol

[@jmdefault]

If you never shut down you are safe against this malware since it never deploys. Checkmate.

[@marsh346]

if it aint broke dunt fix it

[@user-bo8ff2vj7c]

Wow this month is a total nightmare for cybersecurity

[@asdfghyter]

i’m really impressed with the security researchers who managed to figure all this out despite all the efforts to hide and making analysis difficult! also nice to know that my bad habit of always leaving the task manager running has some benefits in making sneaky viruses that are trying to not get caught afraid to come out (9:07)

[@alphadog6970]

escan most likely comes bundled on prebuilds for offices that have 8 hour shifts and most likely they mine at night. Now indian chad employees are not like Timmy in the US and likely install software on their office pc as they see fit and that's why avast was on it.

[@Ludkut]

oh my god you scared me for a moment there i thought I misclicked on a Vegan Gains video. Anyway keep up the good work!

[@ThePaperKhan]

Hah

[@Iswimandrun]

So security software that is is supposed to protect your device if not properly implemented can increase the attack service for your device and used to infiltrate your system neat...

[@CommanderRiker0]

Reminds me of SELinux. There is a long trail of CVE's with it. Probably be better of using the most simple permission model you can with the base permission system. Its 50 years old and just a few dozen's of lines long of simple code.

[@infernys20]

*attack surface

[@SaanMigwell]

It's a well known problem, like ever since Norton abandoned DOS and went with AV. If you add another app/service/applet/daimon etc.., you increase the attack surface. It's that simple.

[@0x0fffff]

@@CommanderRiker0 both SELinux and Apparmor are financed by Microsoft DEI and have NSA contributors, what did you expect?

[@bajs28]

North Koreans also did a ransomware attack on the swedish alcohol dispensary company. Threatening the booze availability.

[@Carl-hs420a]

I imagine how the attack started went down the lines of: "herro parjeet du ru want make morries? plug usb in at wok and I giv you five dorra" and the response "I WILL REDEEM, SAARS!"

[@ahmedp8009]

YT are bunch of pussies for censoring Pa-je-et ...

[@MeowtronStar]

You went so overboard with the talking style that I can barely read what you're saying. They don't use so many Rs.

[@jumpingalex2798]

as an Indian, this is accurate

[@yobson]

sign your updates

[@davenone8516]

Came here to say the same.

[@iamwitchergeraltofrivia9670]

Hhahaahahahah updates cannot signs

[@ahmedp8009]

And always remember ... DO NOT REDEEM!

[@yobson]

@@iamwitchergeraltofrivia9670 mate

[@fsdfgasgfisd]

Thank you for the content, your knowledge as a professional network administrator and in cyber security improved my opsec tremendously.

[@whamer100]

saw this pop up in my phone's notifications and actually clicked on one for once. this sounds like a crazy story

[@Strawberry_champagne203]

Yeah ikr

[@anthonywalker6268]

I'm just surprised someone hasn't thought of it before.

[@uzefulvideos3440]

Some "cracked" antivirus has malware patches.

[@JJFX-]

Yeah who could have thought that anti-virus programs could become a bigger vulnerability than not having one? I'm truly shocked. At least I got the big boys Norton and McAfee working overtime so I know this thing is basically fort knox. And no, I'm not an idiot so I obviously have everything enabled in Dell's control center as well.

[@Moe_Posting_Chad]

@@JJFX- I genuinely can't tell if you're making a joke... This world is awful, something went wrong with it.

[@JJFX-]

@@Moe_Posting_Chad The world broke a long time ago my friend.

[@paperluigi-gs8cs]

they should have used protogent

[@Hotshot2k4]

Ironically it was poor security practices (having both eScan and Avast running at the same time) which led to Avast discovering this attack in the first place

[@user-hm9is5ke9i]

Sirs, did North Korea just redeem?

[@RadicalAntifa]

Slavic sh!t

[@0x0fffff]

WHY DID THEY REDDEEM EET!?

[@snafu5563]

Anti-virus is not enough. You need PROTEGENT

[@LockeIProd]

WORLD'S ONLY ANTIVIRUS WITH DATA RECOVERY SOFTWARE

[@Fridelain]

It would be interesting to implement software that makes bare metal look as much like it's a VM as posible

[@preppyshai]

Wow- also vids with ur face I feel makes the video better

[@vlatan-zl7zh]

I really don't use Indian AV products, btw are you related to Jayson Tatum ?

[@LockeIProd]

Proto would be proud

[@masterdoyen]

You should do a video on the different hacking groups, one that I've just found out about is the cult of the dead cow, its really interesting.

[@MrGFYne1337357]

Wish you made more videos. Everything is crap these days.

[@ultimatums1]

Quality over quantity

[@blackspider4]

How so?

[@istvanbarta]

Ok, this eScan probably obvious for lot of us here, but there was problem eg with Avast too when they sell user data and we hear other misuse news about bigger antivirus companies for time to time. So what is the good approach to find the safest antivirus software supplier?

[@dimitralex1892]

dont. on ms the deafult defender is enough. any av is a door for maleware (due to its admin privileges) and most av is not secure at all... use your brain, dont download shady stuff without VM, dont run foreign code, dont visit untrusted sites... more or less: use your brain instead of being braindead "because you are secure because you have AV"

[@Sv5YpWTwd9otTA4So83f]

install Kaspersky

[@jumpingalex2798]

Quick Heal Antivirus Pro Max Advanced Web Protect

[@leonardoalfonso7080]

Please make a video about your minimalist lifestyle. I have a lot of respect for people live below their means.

[@Griimnak]

ples install kindly

[@noble6978]

I’m way ahead of them, I have Norton 360. Norton already hijacked my pc 😎

[@KGBSpyGeorgeCostanza]

Was wondering about you bud

[@WolfmanDude]

The Kitboga memes in the comments make me soo happy :D

[@theoneandonlymichaelreeves5279]

explains why I have no wifi

[@iSaidNo666]

Wat

[@terjakamp]

but u have cable internet

[@imgladnotu9527]

uh oh... stinky

[@tremon3688]

Babe, new indi home packet phoenix just dropped

[@theperfectionist1607]

UHHH NOO SAAR NO VIRUS

[@QP9237]

The name is unfortunate cuz it immediately sounds like "e-scam". Reminds me of "sudden valley" from arrested development 😂

[@Sigma_Male_Anti_Female]

How does north Korea have so many hackers?

[@nurucdo]

Government sponsored

[@kevinladd2583]

Also im pretty sure the learn how to do it in China.

[@Moe_Posting_Chad]

jews Why do you even ask anymore? Follow that trail of fucking breadcrumbs and it always leads back to jews trying to abuse people.

[@bajs28]

They're running in shifts on their computer

[@looksneed6074]

They are called best Korea for a reason

[@battokizu]

Man in the middle of my favorite Michael Jackson song.

[@KGBSpyGeorgeCostanza]

How secure is tutanota? Sorry if this seems like a silly question?

[@jinmong5417]

Definitely better than Google

[@KGBSpyGeorgeCostanza]

@@jinmong5417 oh I agree, rather use that than Gmail

[@user-el4su7tl6f]

look up the rcmp agent saying its a 🍯pot

[@KGBSpyGeorgeCostanza]

@@user-el4su7tl6f why is that never brought up, can I have a source of that, and what is your recommendation then

[@chanpasadopolska]

It's good. Germans really investing in cyber security after big scandal with US government involved. I can reccomend German IT solutions.

[@greptheloot]

I wonder, does the auto-kill work based on filenames (like wireshark.exe) or is it based on behavior of packet interception code, modules, lib dependencies? like, will T-shark raise the same flag? if it's nation state, shit prolly.

[@alexandrustefanmiron7723]

So you need multiple avs. Super!

[@jojoagogo]

Thank you kindly for doing the needful.

[@wyleong4326]

Maybe we should head back to simple DOS systems.

[@UAlk.]

the best antivirus is common sense, nothing will ever beat that

[@markusasennoptchevich2037]

Pajeet software quality TM

[@DonVigaDeFierro]

How do you pay the license? Amazon gift cards?

[@ultimatums1]

@@DonVigaDeFierro tree command

[@VivekYadav-ds8oz]

Ok most of these were not in taste but this one made me laugh lmfao

[@ultimatums1]

@@VivekYadav-ds8oz no one cares. truth hurts, vivek.

[@hrr597]

​@@ultimatums1 silence American

[@fal1026]

Definitely need a normie video on antivirus for PCs & Androids, this shit never ends, & cyber warfare is like biological warfare, it doesn't care where it's targeted.

[@Moe_Posting_Chad]

Oh. Easy. Antivirus is just a virus. The idea is that maybe it can be a benign virus that tries to prevent other viruses from contaminating your system. It never works.

[@ra2enjoyer708]

It's too late for normies. No amount of antiviruses will help with the habit of running everything as super user.

[@Moe_Posting_Chad]

The future is a cloud based OS on a touch screen and the screen will dictate your life to you. We have to stop this nightmare from manifesting.

[@ayden8901]

Bitdefender and eset are good choices that arent windows defender

[@OpiatedBliss]

REDEEMED!

[@panhandlep]

Wait, but isn't Avast the malware? I am confusion

[@DanT-dh8lz]

next podcast when??

[@lawrencespicher1769]

Feels illegal to be this early

[@sternik8936]

Pray Terry

[@ARESABI]

that shirt is fire

[@DreadHalfling9]

Can you do a video on the fbi crypto warning?

[@Chris47368]

And to think: All they had to do was sign their update files and it would have prevented this....some amazing anti virus company 🙄

[@faceheadman]

Proving once again the best antivirus is no antivirus (plus common sense)

[@KGBSpyGeorgeCostanza]

Oh well

[@BrennanWest85]

I see a Mental Outlaw video, I click.

[@emmettturner9452]

Me too but when I see this unoriginal comment, I also click… downvote.

[@BrennanWest85]

@@emmettturner9452 Is it really unoriginal to show support and appreciation for a content creator though?

[@BrennanWest85]

@@emmettturner9452 God forbid someone show a content creator appreciation.

[@emmettturner9452]

@@BrennanWest85 God forbid using the comments for constructive feedback without drowning out what little there is. ;)

[@BrennanWest85]

@@emmettturner9452 With that mindset and attitude I wonder why YT ghosts your comments? 😌

[@user-ew8lt6yi2i]

"if u're using escan" lol who in his right mind would use anything made in poopinstan

[@w__a__l__e]

you mean the thing facebook did that was 100% ok and no one was held accountable..

[@conzmoleman]

How can you not root for NK. Love those scrappy guys.

[@notklye]

3:56 Are you meaning to tell me they did allat with this malware, but they left RTTI just chilling 💀

[@JabbaTiure]

We need a Kim Jong-un wojak.

[@ensuntermenschens9248]

Is my arch Linux effected?

[@RoofusRoof19]

arch linux reduces testosterone by up to 30%

[@mikeb1085]

imma just drop this here. people who think applying patches/updates as soon as theyre released is a good idea r trds. and ppl who have automatically updating software r also trds

[@isheamongus811]

Fyi Avast also lets do do a file scan, a boot scan...

[@TheDjarto]

How update if update server bad 😅

[@OutSideTheBoxYT2]

i like how north korea has nothing and no internet and the people dont have advanced tech but somehow these intelligent north korean hackers keep reappearing

[@ClamBow]

Is norton update hijacked?

[@SB-qm5wg]

Then the victim gets a call from Microsoft Support?

[@0x0fffff]

MAAM WHY ARE YOU REDEEMING!?

[@SOULBREAKER-se8bq]

❤🇰🇵❤

[@Kellestial]

I hope every scammer call centre had eScan installed

[@KiamKweli]

Well played NK.

[@SaanMigwell]

I think Windows and Linux/Unix should be required courses in elementary school. As in they have to be able to write scripts/macros and master every CLI/Shell. Of course that would destroy the AV software club. You really don't need it once you know how to talk to your computer in it's language.

[@admontblanc]

I'm a complete retard with no knowledge about software, but while you are technically right in a perfect world, we just don't live in one. A decent AV program solves problems automatically, if we actually reached the point where any regular PC user could craft their own AV program then that would be great, but it's not a realistic expectation in the foreseeable future.

[@notklye]

@@admontblancdon’t need to even craft your own if you simply are educated enough on internet safety and red flags of how you would end up with malware / noticing if you may be compromised. Haven’t used AV for god knows how long and I have had no issues with being compromised. I think that is what OP is trying to say, as opposed to making your own AV.

[@SoloElROY]

What a relief 😮‍💨 I don't use antivirus

[@SoloElROY]

Only my Russian minified version of windows 🫵

[@SheikhAsadAhmad]

The support calls would be hilarious where they would first Not understand the problem than try to further scam you 🤪😁

[@ahmedp8009]

LMFAOOOO

[@admontblanc]

😂😂😂

[@Sv5YpWTwd9otTA4So83f]

Thank you Sir Pakistan #1

[@lordsneed9418]

How are North Koreans so epic?

[@bewawolf19]

They are until you realize they spent a fifth of their yearly revenue to do this.

[@user-zg2bx4oz2p]

didin't even know they could use internet

[@fatman7064]

​@@bewawolf19Do pwn some durka durks? Worth it

[@user-qr4jf4tv2x]

russia and china is helping them so we don't blame Russia and china directly

[@TheGhostFart]

@@user-zg2bx4oz2p they can but it makes the great firewall of china look like our open internet.

[@Jerichei]

EEEEYIKES!

[@cursedgamer2778]

everyone commenting rn is a glowie

[@kingqwilwinters7610]

Those damn reds! XD

[@jinmong5417]

That’s exactly what a fed would comment..

[@somerandomguywastaken]

You're looking for your coworkers?

[@hueyPneutron]

see you at the next golf gathering john

[@TheGhostFart]

no u

[@rustym.shackelford5546]

Based Korea strikes again.

[@MrSongib]

For Science, I once tried to run Multiple antivirus at the same time, and it's great. xd

[@chanpasadopolska]

Respect to Korea

[@czaczaczar]

WTF is escan? I've never heard of that antivirus.

[@0x0fffff]

e-Scam

[@DonVigaDeFierro]

Here hoping they hack Protegent. Just imagine the memes.

[@jp6568]

Using eScam is crazy

[@kockoklosharcheto]

Why are there so many steps? Isnt all of that redundant? I have absolutely no experience with hacking, but whats the problem of just "sideloading" the "pupeteer" if that even makes any sense? Whats the need for all the command and control servers or malicious pdf logo file?

[@FebruaryWashington]

I'm no cyber techie but my guess is that it's to make what the malware does a lot harder to track down, especially what the IP distributing those payloads are

[@isbestlizard]

Oh come on it's 2024 if anyone is still writing software that updates without signature verification then fuck them

[@Alex-hj2jd]

Wait, so the virus is stored in a png?

[@notklye]

A stage of the malware is stored in a png. That does not mean you get the virus on your machine by downloading a png and opening the picture, that wouldn’t cause it to be executed. There is shellcode that is stored in the png most likely at the end of the file, which that shellcode is then extracted by a previous stage of the malware that is already running and then used accordingly. That shellcode is more than likely stored in the png to help obscure analyzers from knowing how the malware operates, since the png is downloaded from their private DNS server it would just appear that your machine made a request to a legit site and requested a png, pretty normal appearing. Hope this helps.

[@paljain01]

I think the victims may have installed a crack version of eScan.

[@ChickenMan666]

lol indian antivirus , never thought i'd hear something this funny !

[@Grocho14]

Can't trust anyone and anything these days!