eScan Antivirus Update Server Hijacking via Hosts File

S@1@N .@kohtet

•updated Feb 2, 2026•0•17

Detects modification of the Windows hosts file to redirect eScan antivirus update servers (e.g., update1.mwti.net) to the non-routable IP address 2.3.4.0. This behavior prevents antivirus updates and is indicative of defense evasion or supply-chain related tampering.