Geekom Shipped Malware-Laced Network Drivers for AMD Mini PCs

Malware Discovered in Geekom Drivers

Geekom has confirmed that network drivers available on its website for several AMD mini-PC models were infected with the Asruex backdoor malware. The affected models include the A7, A8, AE7, AE8, AX7 Pro, and AX8 Pro series. This discovery was initially reported by Videocardz, which verified the presence of the malware using multiple detection engines.

Impact of the Malicious Software

The Asruex malware, embedded within the driver installer, gained administrator-level permissions upon installation. This level of access allowed the malware to potentially steal user data, intercept keystrokes, retrieve passwords, and establish connections to command-and-control centers for remote access to the compromised PC. Users who installed these drivers are at significant risk.

Company Response and User Guidance

Geekom has removed the compromised software package from its website and issued an apology. The company stated that the malicious driver was located on a "legacy page" that was no longer accessible through normal support navigation but remained indexed by search engines. Geekom advises users who installed the affected LAN driver to perform a full system wipe or, at minimum, an offline Windows Defender scan to mitigate the threat.

Background and Context

This incident highlights the risks associated with downloading software, even from manufacturer websites, especially when relying on search engines to locate specific files. Unlike previous incidents where devices shipped with malware pre-installed, such as with AceMagic machines or Asus software updates, the Geekom mini-PCs themselves were not vulnerable out-of-the-box. The issue stemmed from a downloadable driver package.