--- title: GuptiMiner: North Korean Hackers Exploit Antivirus... description: A sophisticated malware campaign called GuptiMiner, possibly orchestrated by North Korean APT group Kimsuky, exploits antivirus updates to distribute backdoors... canonical: https://daily.dev/posts/guptiminer-north-korean-hackers-exploit-antivirus-updates-to-distribute-backdoors-and-coinminers-hm1njhcbt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GuptiMiner: North Korean Hackers Exploit Antivirus Updates to Distribute Backdoors and Coinminers | daily.dev og:description: A sophisticated malware campaign called GuptiMiner, possibly orchestrated by North Korean APT group Kimsuky, exploits antivirus updates to distribute backdoors... og:url: https://daily.dev/posts/guptiminer-north-korean-hackers-exploit-antivirus-updates-to-distribute-backdoors-and-coinminers-hm1njhcbt og:image: https://api.daily.dev/og/posts/HM1NjHcBt.png og:image:alt: GuptiMiner: North Korean Hackers Exploit Antivirus Updates to Distribute Backdoors and Coinminers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GuptiMiner: North Korean Hackers Exploit Antivirus Updates to Distribute Backdoors and Coinminers **[Collections](https://daily.dev/sources/collections)** · 1 min read · 1 upvotes · 0 comments ## Summary A sophisticated malware campaign called GuptiMiner, possibly orchestrated by North Korean APT group Kimsuky, exploits antivirus updates to distribute backdoors and coinminers. The campaign employs various techniques, targets corporate networks, and highlights the need for robust security measures. ## Content A highly sophisticated malware campaign called GuptiMiner has emerged, orchestrated by a threat actor possibly affiliated with North Korean APT group Kimsuky. This campaign takes advantage of an antivirus update mechanism to distribute backdoors and coinminers. The malware employs various techniques, including an infection chain, DNS requests to attacker's servers, sideloading, and payload extraction from innocent-looking images. Infected devices are targeted with the XMRig coinminer. GuptiMiner evolves over time, incorporating advanced obfuscation techniques and anti-VM measures. It even deploys a customized version of PuTTY Link for local SMB network scanning and lateral movement across Windows 7 and Windows Server 2008 systems. Notably, the backdoor is deployed on devices connected to large corporate networks. Recently, suspected North Korean hackers executed a man-in-the-middle attack against eScan, an Indian software security company. This attack deceived victim's machines into communicating with a malicious update server, ultimately downloading the GuptiMiner malware. The malware is highly sophisticated and employs multiple tactics to hide its traffic and evade detection. Linked to the North Korean state-sponsored hacking group, Kimsuky, the campaign highlights the growing threat of malware exploits and the need for robust security measures. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/guptiminer-north-korean-hackers-exploit-antivirus-updates-to-distribute-backdoors-and-coinminers-hm1njhcbt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GuptiMiner: North Korean Hackers Exploit Antivirus Updates to Distribute Backdoors and Coinminers","url":"https://daily.dev/posts/guptiminer-north-korean-hackers-exploit-antivirus-updates-to-distribute-backdoors-and-coinminers-hm1njhcbt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/guptiminer-north-korean-hackers-exploit-antivirus-updates-to-distribute-backdoors-and-coinminers-hm1njhcbt"},"datePublished":"2024-04-26T00:35:40.298Z","dateModified":"2024-04-26T00:35:39.142Z","description":"A sophisticated malware campaign called GuptiMiner, possibly orchestrated by North Korean APT group Kimsuky, exploits antivirus updates to distribute backdoors...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a38ffad3494f57b3801d61b8bb6d466?_a=AQAEufR","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a38ffad3494f57b3801d61b8bb6d466?_a=AQAEufR","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/guptiminer-north-korean-hackers-exploit-antivirus-updates-to-distribute-backdoors-and-coinminers-hm1njhcbt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"GuptiMiner: North Korean Hackers Exploit Antivirus Updates to Distribute Backdoors and Coinminers"}]} ```