Bypass Record
DLL Side-Loading × eScan antivirus
A publicly-reported instance of DLL Side-Loading bypassing eScan antivirus, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
eScan delivered updates over unencrypted HTTP without digital signature verification. Attackers intercepted update requests via MitM, replacing the update package with a malicious one that used DLL hijacking to load GuptiMiner. The infection chain also employed a custom DNS server for C2 communication and later IP address masking.
Detection & mitigation
Monitor for eScan processes loading unexpected DLLs from non-standard paths, especially those with network connections to suspicious domains. Ensure update traffic uses HTTPS and verify digital signatures on update binaries. Deploy endpoint detection rules for known GuptiMiner indicators (hashes, C2 IPs/domains).
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.