Go program named update.exe drops the XMRig crypto miner on Windows as ApplyUpdate.exe (Huntress SOC)

On 8 Nov 2026 Huntress SOC analyst 0xffaraday reported, and Huntress repeated, that a Go program named update.exe (SHA-256 f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c) is being dropped on Windows machines and installs the XMRig Monero miner as ApplyUpdate.exe. How it gets on the machine, who is hit and how many organizations are affected are unknown. Huntress posted the GeoVision camera-software attack waves (CMP-202611-alixma) 11 minutes later, but nobody has said the two are linked.