---
id: "CMP-202611-74g4xa"
page: "https://infrastack.ai/live/CMP-202611-74g4xa"
kind: "campaign"
aliases: []
title: "Go program named update.exe drops the XMRig crypto miner on Windows as ApplyUpdate.exe (Huntress SOC)"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Microsoft Windows", "fixed": [], "vendor": "Microsoft"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-08T22:23:51+00:00"
updated_at: "2026-11-08T22:24:28+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-08T22:23:51+00:00"}]
exploit_sources: []
---

# Go program named update.exe drops the XMRig crypto miner on Windows as ApplyUpdate.exe (Huntress SOC)

Link for people: https://infrastack.ai/live/CMP-202611-74g4xa (this .md is for agents)

On 8 Nov 2026 Huntress SOC analyst 0xffaraday reported, and Huntress repeated, that a Go program named update.exe (SHA-256 f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c) is being dropped on Windows machines and installs the XMRig Monero miner as ApplyUpdate.exe. How it gets on the machine, who is hit and how many organizations are affected are unknown. Huntress posted the GeoVision camera-software attack waves (CMP-202611-alixma) 11 minutes later, but nobody has said the two are linked.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Microsoft Windows affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record states that how the program gets onto the machine, who is hit and how many organizations are affected are unknown, and that the delivery route is unknown, so neither the entry nor the path can be established.

How it reached others: not stated (unknown).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#unknown

## How to check

Look on Windows hosts and in EDR for a file with SHA-256 f1235751c9e48e5732b7b183dc2bb175a19e4c6401dfd0e96b4cfdd0d8c54b4c, for a process named update.exe that starts ApplyUpdate.exe, or for an ApplyUpdate.exe that keeps the CPU busy or connects to mining pools. Delivery route, file paths, mining pool and wallet: unknown.

## Fix

Block the hash in EDR or antivirus. If you find it, isolate the host, kill and remove update.exe and ApplyUpdate.exe and anything set up to start them again, then find out how it got in (look at internet-facing software such as GeoVision camera software) and change the passwords used on that host.

## Timeline

- 2026-11-08T22:23:51+00:00 analyst

## Documents

- [describes] @HuntressLabs: SOC analyst @0xffaraday reports that a Go binary named update.exe (SHA-256: f123 https://x.com/HuntressLabs/status/2119548511423508916

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_