ACAD/Medre.A was a worm that stole AutoCAD drawings and sent them to attacker-controlled email accounts using Chinese email providers. ESET disclosed the malware in June 2012 after observing a major concentration of infections in Peru. The evidence supported suspected industrial espionage, but did not establish that the Chinese government sponsored the operation.
What was ACAD/Medre.A?
ACAD/Medre.A was AutoLISP malware with worm, trojan and virus-like characteristics, according to ESET’s 2012 technical analysis. It targeted drawings made with AutoCAD, Autodesk’s computer-aided design software. ESET documented compatibility from AutoCAD 2000 (version 14.0) through AutoCAD 2015 (version 19.2).
The malware combined two functions: it used AutoCAD startup and support mechanisms to run, and it spread by placing copies of itself in locations associated with Windows, the current drawing folder and AutoCAD support directories.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
![AutoCAD 2022 Software [Single User]](https://m.media-amazon.com/images/I/41+Kqxw0WCL._SL160_.jpg)
|
AutoCAD 2022 Software [Single User] | $239.99 | Buy on Amazon |
| 2 |
![AutoCAD 2022 Software [1 User CPU] [Single User] New.](https://m.media-amazon.com/images/I/41mCC1t5nAL._SL160_.jpg)
|
AutoCAD 2022 Software [1 User CPU] [Single User] New. | $249.99 | Buy on Amazon |
| 3 |
|
Cad Software 5 License Autocad Compatible | $1,003.33 | Buy on Amazon |
| 4 |
|
BeckerCAD 15 - 2D software for home design, architecture, engineering and more, compatible with... | $29.99 | Buy on Amazon |
How did the malware run and spread?
ACAD/Medre.A modified a version-specific AutoCAD startup file named acad20??.lsp and loaded cad.fas when a drawing opened. In practical terms, that meant opening a drawing in an infected AutoCAD installation could trigger the malware without the user deliberately launching a separate program.
Recommended Free Tools
By copying itself into drawing and support folders as well as Windows, it could be present in more than one location on an affected computer. ESET’s analysis describes the mechanism and version range; it does not establish that every AutoCAD installation in that range was vulnerable or infected.
#1 Best Overall
- Perpetual Full Version. No expiry. Win 10/11 64bit Machines. No subscription, no additional fees. Online account not included, so no Tech support
- Trace Tool: Provides a safe space to collaborate on drawing changes without altering the original drawing
- Count Tool: Quickly and accurately counts instances of objects in a drawing and inserts a table with the count data
- Floating Drawing Windows: Allows drawing file tabs to be dragged off the main application window to view and edit them as floating windows
- Push to Docs: Allows teams to upload AutoCAD drawings as PDFs to a specific project on Autocad Docs for easy reference in the field
What information did ACAD/Medre.A try to steal?
The main target was the DWG file currently open in AutoCAD. The malware emailed drawings to attacker-controlled accounts, rotating among accounts at 163.com and qq.com. ESET described the destinations as Chinese-provider accounts; the destination alone does not identify who controlled them or prove government involvement.
ESET’s technical analysis also describes attempts to collect Outlook PST and Foxmail files. It notes an encrypted RAR archive containing the worm and a generated DXF file with metadata. The available reporting does not establish that every infection successfully collected or transmitted all of these items.
Rank #2
- Perpetual Full Version. No subscription, no additional fees. Online account not included, so no Tech support . For Win-11 and 10 64-Bit Machines Only
- Trace Tool: Provides a safe space to collaborate on drawing changes without altering the original drawing
- Count Tool: Quickly and accurately counts instances of objects in a drawing and inserts a table with the count data
- Floating Drawing Windows: Allows drawing file tabs to be dragged off the main application window to view and edit them as floating windows
- Push to Docs: Allows teams to upload AutoCAD drawings as PDFs to a specific project on Autocad Docs for easy reference in the field
How many drawings were exposed, and where?
ESET reported that tens of thousands of AutoCAD drawings, primarily from Peru, were leaking when the operation was discovered in 2012. ESET also observed a smaller number of infections elsewhere in Latin America.
A 2012 Virus Bulletin conference abstract by ESET researchers Robert Lipovsky and Sebastian Bortnik gives a separate figure: more than 10,000 AutoCAD drawings leaked over the preceding two years. These figures describe different reporting frames—the scale ESET cited at discovery and the abstract’s two-year total. The available accounts do not clarify how the figures relate or provide a single definitive total.
Why was it described as suspected espionage?
Design files can reveal a product or structure before it reaches production. ESET’s reasoning was that ACAD/Medre.A could automatically send each newly opened design to the attackers, making the operation consistent with industrial espionage. ESET researcher Righard Zwienenberg called it a “serious example of suspected industrial espionage” in 2012.
That characterization is a suspicion based on the malware’s behavior and targets, not proof of the operators’ identity or motive. The reported email destinations were in China, but the cited accounts do not establish a Chinese government sponsor or name a threat group.
Rank #4
- CAD software compatible with AutoCAD and Windows 11, 10, 8.1 - Lifetime License
- Extensive toolbox of the common 2D modelling functions
- Import and export DWG / DXF files
- Professional software for architects, electrical engineers, model builders, house technicians and others
- Realistic 3D view - changes instantly visible with no delays
How was the 2012 campaign disrupted?
ESET worked with Tencent, China’s national computer-virus emergency response center, and Autodesk. The accounts used to relay drawings were blocked, and ESET released a free standalone cleaner at the time. ESET credited the coordinated response with stopping further leakage.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesThe cleaner was a response to the 2012 incident; the historical reporting does not establish that it remains available or appropriate for use today.
What does this incident tell AutoCAD users today?
ACAD/Medre.A is a documented historical case, not evidence of a current outbreak. The cited reporting concerns the 2012 campaign and does not establish a recurrence in 2026. Its enduring lesson is narrower: software startup mechanisms and shared project folders can be abused to make malicious code run alongside ordinary work and to expose files users open as part of that work.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
