{"id":"CMP-202611-74g4xa","kind":"campaign","aliases":[],"related":["CMP-202611-alixma"],"title":"Go program named update.exe drops the XMRig crypto miner on Windows as ApplyUpdate.exe (Huntress SOC)","description":null,"summary":"On 8 Nov 2026 Huntress SOC analyst 0xffaraday reported, and Huntress repeated, that a Go program named update.exe (SHA-256 f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c) is being dropped on Windows machines and installs the XMRig Monero miner as ApplyUpdate.exe. How it gets on the machine, who is hit and how many organizations are affected are unknown. Huntress posted the GeoVision camera-software attack waves (CMP-202611-alixma) 11 minutes later, but nobody has said the two are linked.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-08T22:23:51+00:00","products":[{"name":"Microsoft Windows","fixed":[],"vendor":"Microsoft"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look on Windows hosts and in EDR for a file with SHA-256 f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c, for a process named update.exe that starts ApplyUpdate.exe, or for an ApplyUpdate.exe that keeps the CPU busy or connects to mining pools. Delivery route, file paths, mining pool and wallet: unknown.","fix":"Block the hash in EDR or antivirus. If you find it, isolate the host, kill and remove update.exe and ApplyUpdate.exe and anything set up to start them again, then find out how it got in (look at internet-facing software such as GeoVision camera software) and change the passwords used on that host.","status":"open","published_at":null,"first_seen_at":"2026-11-08T22:23:51+00:00","triaged_at":"2026-11-08T22:23:51+00:00","updated_at":"2026-11-08T22:24:28+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-08T22:26:03Z","path":"unknown","entry":"unknown","reason":"The record states that how the program gets onto the machine, who is hit and how many organizations are affected are unknown, and that the delivery route is unknown, so neither the entry nor the path can be established.","confidence":0.9}},"analyst_status":"done","analyst_note":null,"search":"'-202611':17A,88B '-256':45B '-74':18A '0xffaraday':33B '11':90B '2026':29B '8':27B 'affect':75B 'alixma':89B 'analyst':32B 'applyupdate.exe':13A,60B 'attack':85B 'camera':83B 'camera-softwar':82B 'campaign':22B 'cmp':16A,87B 'crypto':8A 'drop':5A,49B 'earli':24B 'early-warn':23B 'f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c':46B 'g4xa':19A 'geovis':81B 'get':63B 'go':1A,40B 'hit':69B 'huntress':14A,30B,36B,78B 'instal':54B 'later':92B 'link':100B 'machin':52B,66B 'mani':72B 'microsoft':20A 'miner':9A,58B 'minut':91B 'monero':57B 'name':3A,42B 'nobodi':94B 'nov':28B 'organ':73B 'post':79B 'program':2A,41B 'repeat':37B 'report':34B 'said':96B 'sha':44B 'soc':15A,31B 'softwar':84B 'two':98B 'unknown':77B 'update.exe':4A,43B 'warn':25B 'wave':86B 'window':11A,51B 'windows':21A 'xmrig':7A,56B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["microsoftwindows","windows"],"ptokens":["microsoft","windows"],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"malware","search_a":"'-202611':17A '-74':18A 'applyupdate.exe':13A 'cmp':16A 'crypto':8A 'drop':5A 'g4xa':19A 'go':1A 'huntress':14A 'microsoft':20A 'miner':9A 'name':3A 'program':2A 'soc':15A 'update.exe':4A 'window':11A 'windows':21A 'xmrig':7A","search_b":"'-202611':88B '-256':45B '0xffaraday':33B '11':90B '2026':29B '8':27B 'affect':75B 'alixma':89B 'analyst':32B 'applyupdate.exe':60B 'attack':85B 'camera':83B 'camera-softwar':82B 'campaign':22B 'cmp':87B 'drop':49B 'earli':24B 'early-warn':23B 'f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c':46B 'geovis':81B 'get':63B 'go':40B 'hit':69B 'huntress':30B,36B,78B 'instal':54B 'later':92B 'link':100B 'machin':52B,66B 'mani':72B 'miner':58B 'minut':91B 'monero':57B 'name':42B 'nobodi':94B 'nov':28B 'organ':73B 'post':79B 'program':41B 'repeat':37B 'report':34B 'said':96B 'sha':44B 'soc':31B 'softwar':84B 'two':98B 'unknown':77B 'update.exe':43B 'warn':25B 'wave':86B 'window':51B 'xmrig':56B","search_c":"","cause_entry":"unknown","cause_path":"unknown","disclosures_checked_at":null,"first_public_at":"2026-11-08T21:51:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-74g4xa","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-08T22:23:51+00:00","fetched_at":"2026-11-08T22:23:51+00:00","note":null}],"documents":[{"id":103992,"url":"https://x.com/HuntressLabs/status/2119548511423508916","title":"@HuntressLabs: SOC analyst @0xffaraday reports that a Go binary named update.exe (SHA-256: f123","kind":"post","source":"x","publisher":null,"text":"SOC analyst @0xffaraday reports that a Go binary named update.exe (SHA-256: f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c) deploys XMRig as ApplyUpdate.exe. https://t.co/66oBNie4j1\n\nlikes 3 reposts 0","published_at":"2026-11-08T21:51:59+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}