Avast analyzed GuptiMiner, a long-running malware operation that hijacked the eScan antivirus update mechanism through a man-in-the-middle attack to deliver backdoors and XMRig. The infection chain used DNS requests to attacker-controlled DNS servers, DLL sideloading, payloads hidden in appended image data, and payloads signed with a custom trusted root certificate authority. Avast found two backdoor families for large corporate networks: an enhanced PuTTY Link build for SMB scanning and lateral movement, and a modular backdoor that can install more modules and search for private keys and cryptowallets. The report describes possible ties to Kimsuky based on similarities between a Kimsuky keylogger and parts of the GuptiMiner operation.