Sunday, May 19, 2024

Chinese Mini PC Maker Acemagic Ships machines with Malware Pre-installed

Acemagic, a Chinese manufacturer of mini PCs, has been found to ship devices laden with malware, raising significant concerns about cybersecurity and consumer safety.

Further investigations revealed that other models, including the AD15 and S1, also harbored similar malicious software.

You can analyze a malware file, network, module, and registry activity with the ANY.RUN malware sandbox and the Threat Intelligence Lookup that will let you interact with the OS directly from the browser.

A Troubling Discovery

Jon from The Net Guy Reviews YouTube channel first brought this issue to light when he discovered spyware in the AceMagic AD08 mini-PC.

Jon’s encounter with the malware began when Windows Defender detected suspicious files on the recovery partition of the NVMe drive inside the AceMagic AD08.

These files, identified as ENDEV and EDIDEV, were part of the Bladabindi and Redline malware families, notorious for stealing stored passwords, logging keystrokes, and extracting information from infected systems.

A comprehensive system scan unearthed additional spyware files hidden in the Windows folder, with VirusTotal confirming the malicious nature of these files as flagged by 50 security vendors.

Windows Defender found malicious files in the recovery partition of the AceMagic AD08’s NVMe SSD, which the reviewer obtained via FBA dropshipping.

AceMagic AD08 with malware
AceMagic AD08 with malware

The problem appears more widespread than initially, with other users reporting similar experiences.

One Amazon buyer of the AceMagic AD08 reported encountering malware that was hardcoded into the Windows recovery, making it immune to standard reset procedures.

Another user, Richard Deno, found malware in his AK1 model, including pre-installed Chrome, that he deemed untrustworthy due to the presence of other malware.

Company Response

In response to these alarming findings, Acemagic has acknowledged the issue, attributing it to software adjustments developers made to reduce initial boot times.

These adjustments, which involved tampering with Microsoft source code and network settings without proper digital signatures, led to the accidental inclusion of malware in some of their products manufactured before November 18, 2023.

Acemagic has committed to refunding affected customers and advised checking the device’s production date for eligibility.

The company has also promised to strengthen its use of digital certificates to prevent unauthorized modifications in the future.

Future Measures and Consumer Advice

Acemagic has outlined a comprehensive plan to address consumer concerns and mitigate the impact of the virus incident.

This includes a return policy for affected products, a product retention policy offering compensation for those who choose to keep their devices, and an exchange service.

For consumers who own an AceMagic mini-PC or devices from its sub-brands, it is advisable to run a virus scan to ensure their systems are malware-free.

The incident is a stark reminder of the cybersecurity risks associated with purchasing technology products and underscores the importance of vigilance and due diligence from manufacturers and consumers.

In conclusion, the discovery of pre-installed malware on Acemagic mini PCs has shed light on the critical issue of cybersecurity in manufacturing.

As Acemagic takes steps to rectify the situation and prevent future occurrences, consumers are urged to remain cautious and proactive in safeguarding their digital security.

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are incredibly harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.


Latest articles

Hackers Exploiting Docusign With Phishing Attack To Steal Credentials

Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make...

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles