Loading story…
Geekom acknowledged that a Realtek LAN driver package hosted on a legacy support page for several AMD-based mini PCs was infected with the Asruex backdoor/Trojan. Reported affected models include the A7, A8, AE7, AE8, AX7 Pro, and AX8 Pro. The malicious installer was reportedly still reachable through search engine indexing even after Geekom replaced its older support system, allowing users to download what appeared to be a legitimate vendor driver from the company’s website.
Because the malware was embedded in a driver installer, it could execute with elevated privileges and enable remote access, data theft, keystroke capture, and password theft. Geekom said there is no indication systems shipped infected out of the box and that the exposure is limited to users who downloaded and ran the legacy package. The company removed the file and said it is reviewing obsolete support resources, while guidance to affected users includes deleting the installer, scanning systems, reinstalling drivers from trusted current sources, and in higher-risk cases performing a full system wipe or an offline Microsoft Defender scan.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Both reports state that Geekom asked VideoCardz to consider removing its original reporting, but VideoCardz declined. The outlet maintained the report after Geekom confirmed the issue.
Geekom apologized to users and advised anyone who downloaded the installer to delete it and avoid running it. Users who executed it were told to run a full anti-malware scan, replace the driver from trusted sources, and in higher-risk cases consider a clean Windows reinstall or full system wipe.
After the issue was identified, Geekom said it removed the malicious software package and was removing the obsolete files and pages associated with the incident. The company also said it was reviewing or tightening support-resource management procedures.
Geekom acknowledged that the malicious driver package was hosted on an outdated support resource that had been replaced and was no longer reachable through normal navigation, though it remained indexed by search engines. The company said its pre-installed Windows images did not include the flagged file, indicating the issue was tied to the downloadable package rather than out-of-box infection.
The reporting says VideoCardz validated the presence of Asruex in the driver package using VirusTotal, FileScan.IO, MetaDefender, and Yarafy. This confirmed the installer was malicious rather than a false alarm.
VideoCardz discovered that a downloadable Geekom Realtek/LAN driver package hosted on a legacy support page was infected with the Asruex backdoor. The affected exposure applied to users who downloaded and executed the installer from Geekom's website, not to factory-shipped systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ASUS patched two vulnerabilities in its preinstalled **DriverHub** software that can be chained to achieve unauthenticated remote code execution on affected Windows systems. The flaws, tracked as `CVE-2025-3462` and `CVE-2025-3463`, affect DriverHub versions earlier than **1.0.6.0** and stem from insufficient certificate and origin validation in the utility’s update and installation workflow. Researchers reported that the bugs allow a malicious website to interact with DriverHub through specially crafted HTTP requests and trigger code execution with minimal user interaction. According to public reporting and ASUS’s security advisory, the attack abuses a `driverhub.asus.com.<arbitrary>.com`-style domain to pass validation checks, causing DriverHub to launch `AsusSetup.exe` in silent mode and process a malicious `AsusSetup.ini` file that redirects installation to attacker-controlled code. CSIRT.SK said successful exploitation could fully compromise the confidentiality, integrity, and availability of a victim machine. ASUS has released updates and urged users to upgrade DriverHub immediately to version **1.0.6.0** or later.
Jul 24, 2026
Huntress reported an intrusion in which attackers deployed a custom **EDR killer** that disables endpoint security by abusing a legitimate but long-revoked kernel driver originally shipped with Guidance Software’s *EnCase* forensics product. The malware embeds the vulnerable driver (reported as `EnPortv.sys`) and uses a **Bring Your Own Vulnerable Driver (BYOVD)** approach: once the driver is loaded, it exposes an `IOCTL` interface that enables user-mode code to terminate arbitrary processes from kernel mode, bypassing user-mode protections including **Protected Process Light (PPL)**. The tool is described as capable of targeting **59** endpoint security products. In the observed incident, initial access was achieved by successfully authenticating to **SonicWall SSL VPN** using previously compromised credentials, with reporting noting the absence of **MFA** on the VPN account. Post-compromise activity included internal reconnaissance (e.g., ICMP ping sweeps, NetBIOS/SMB probing) and high-rate SYN activity, followed by execution of the EDR killer disguised as a legitimate utility (e.g., a firmware update tool). The malware reportedly uses a custom encoding scheme to conceal the embedded driver, writes it to disk under an OEM-like path, hides it, timestomps it to blend in, and registers it as a Windows kernel service for persistence; despite the driver’s certificate being expired and revoked for years, Windows can still load it due to signature verification and timestamping behavior.
Jul 4, 2026
Researchers and threat intelligence sources detailed multiple signed Windows kernel drivers being abused to gain stealthy, high-privilege access and disable defenses. Nextron Systems analyzed `wskmon.sys`, a WHQL-signed Windows Filtering Platform driver that acts as a kernel-resident network backdoor by intercepting inbound TCP traffic and accepting encrypted, HMAC-authenticated commands marked with the magic bytes `7F 4E 54 46`. The malware reportedly enables remote shell execution, arbitrary file writes, and shellcode execution directly from kernel context, allowing it to operate on Secure Boot systems while leaving few user-mode artifacts. Separate LOLDrivers entries highlighted two additional signed drivers tied to ESET’s reporting on Gentlemen ransomware activity: Qihoo’s `360netmon_wfp.sys`, tracked as `Win64/VulnDriver.Qihoo360.A`, and IObit Malware Fighter’s `IMFForceDelete.sys`, associated with `CVE-2019-6494`. The first can be abused to impair endpoint protections and support EDR-killing activity, while the second can be loaded to delete protected files regardless of access controls via `IOCTL 0x8016E000`. Across the reports, defenders were urged to block these drivers, monitor for suspicious signed driver loads and unexpected WFP callout registration, and hunt for indicators such as anomalous `svchost.exe` child processes, kernel-originated file overwrites, and protocol markers in network traffic.
Jun 29, 2026