Geekom admits shipping malware-laced AMD mini-PC network drivers and removes infected package

Geekom acknowledged that a legacy LAN driver installer for its AMD-based mini-PCs was compromised with the Asruex backdoor malware. The driver was hosted on a support page that had been replaced but remained indexed by search engines, increasing the likelihood of unintended downloads. The company removed the infected package after the issue was reported, but the initial response included a request for the reporting outlet to retract its coverage, which was denied.

The malware’s presence in a driver installer is particularly concerning because drivers run with elevated privileges. This grants the malware full access to the system, enabling actions like data theft, keystroke logging, and establishing persistent remote access via command-and-control servers. Engineers managing these mini-PCs should treat any system that installed the driver as potentially compromised, with a full wipe being the most reliable mitigation.

The incident highlights the risks of sourcing drivers from manufacturer websites, even for legitimate hardware. While Windows Update is the recommended source for drivers, users often turn to OEM sites for the latest versions or to troubleshoot issues. The fact that the infected driver was on a legacy page, still discoverable via search, demonstrates how easily such threats can persist. Corroboration by multiple malware detection engines confirms the threat was real, not a false positive.

This case mirrors past incidents where malware was distributed via official channels, such as AceMagic’s factory-shipped malware or Asus’ compromised software updates. Unlike those examples, Geekom’s mini-PCs were not infected out-of-the-box, but the driver’s availability on a legacy page created a similar risk. The event serves as a reminder that even trusted vendors can inadvertently distribute malware, and engineers must verify driver integrity before installation.