Asruex Trojan Found Embedded in GEEKOM Mini PC Realtek Ethernet Driver

GEEKOM has confirmed that a malware-flagged Realtek LAN driver package was previously accessible through an outdated support page for its mini PCs, raising fresh supply-chain security concerns around vendor-hosted driver downloads.

The company said the affected file was confined to a legacy resource, not its current support portal or factory-installed Windows images.

The incident came to light after users reported that antivirus engines identified the driver installer as containing the Asruex Trojan.

The package was distributed as a Realtek Ethernet driver download through GEEKOM-owned infrastructure, meaning users seeking a routine network-driver update could have retrieved a potentially malicious executable from a trusted vendor domain.

Although the legacy page was no longer linked through the website’s normal navigation, it could still be discovered via search engines and accessed directly.

GEEKOM has not disclosed how the malware became embedded in, or associated with, the hosted driver archive.

The distinction is important: the company stated that the issue did not affect GEEKOM hardware itself or the Windows installation preloaded on its devices.

Exposure is instead limited to systems where users downloaded or executed the specific flagged LAN-driver package from the legacy page.

Still, the event illustrates a recurring operational gap in software supply-chain hygiene: decommissioned web resources can remain searchable, trusted by users, and capable of distributing outdated or compromised files long after an organization has migrated to a replacement portal.

Asruex has been associated with malicious activity that can include stealthy execution, persistence, and follow-on payload delivery, making its appearance in a driver installer especially concerning.

According to GEEKOM’s statement, the vulnerable distribution path resulted from an old support page that remained publicly reachable after the company deployed a newer support system.

Driver packages are routinely run with elevated privileges, and users commonly treat them as low-risk because they originate from OEM support pages.

Realtek Ethernet Driver

A trojanized installer in that delivery channel can therefore bypass a critical layer of user skepticism.

GEEKOM said it reviewed files on its current support pages and found no comparable anomalies. The company is removing the affected legacy pages and files, while also tightening resource-management and review processes.

Its response acknowledges that the file was hosted on its infrastructure, despite the obsolete page no longer being linked from the main support navigation.

Users who downloaded the affected Ethernet driver should delete any stored installer immediately and avoid running it.

Systems where the file may have been executed should receive a full scan using Microsoft Defender or another reputable endpoint-security product.

GEEKOM recommends reinstalling the network driver through Windows Update, Realtek’s official distribution channels, or the company’s updated support portal.

It also suggests a clean Windows installation from an official Microsoft image for users seeking the strongest remediation assurance.

The case reinforces several practical safeguards for enterprise administrators and home users.

Driver provenance should be validated beyond the apparent legitimacy of a vendor domain; teams should inspect digital signatures, compare hashes where vendors publish them, and prefer managed update mechanisms where possible.

Security teams should also treat antivirus detections involving hardware-driver packages as a supply-chain incident until proven otherwise, retaining the installer for controlled analysis, reviewing endpoint telemetry, and hunting for suspicious post-execution activity.

GEEKOM’s acknowledgement resolves the question of whether the flagged file was served from its environment, but the initial compromise vector remains unconfirmed.

That unanswered question matters: without clarity on whether the issue stemmed from a compromised upload workflow, third-party package source, credential exposure, or a historical hosting failure, defenders cannot fully assess the risk of recurrence.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now