'Harmless' Global Adware Transforms Into an AV Killer

Dragon Boss Solutions LLC, a threat actor posing as a UAE-registered company, pushed a malicious update in March 2025 that transformed its adware into an antivirus killer. The update disabled AV tools from ESET, McAfee, Kaspersky, and Malwarebytes, established persistence via scheduled tasks, and excluded future payloads from Windows Defender across nearly 24,000 systems in 124 countries. Researchers at Huntress discovered the primary update domain was unregistered, sinkholed it for $10, and found infected systems included 35 government entities, 41 OT networks, and 221 higher education institutions. The incident highlights how adware can rapidly escalate into a full malware delivery platform, and how unregistered update domains create open backdoors for any attacker to exploit.