Microsoft claims CyberLink has been breached by North Korean hackers
Another supply chain attack with possibly devastating consequences
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
North Korean hackers appear to be drawing inspiration from their Russian counterparts following new reports of a major supply chain attack not unlike the notorious 2020 Solarwinds hack.
Microsoftsecurity researchers haveclaimedLazarus Group (AKA Diamond Sleet), an infamous North Korean state-sponsored threat actor, breached the networks of CyberLink, a known multimedia company from Taiwan.
The group used this privilege to infect one of CyberLink’s installers withmalware, resulting in infections wherever the software was updated.
Reader Offer: $50 Amazon gift card with demoPerimeter 81’s Malware Protection intercepts threats at the delivery stage to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security.
Preferred partner (What does this mean?)
LambLoad
Earliest signs of the attack point to late October 2023, Microsoft’s report said, with at least 100 endpoints have been compromised, located everywhere from Japan and Taiwan, to Canada and the United States.
“Diamond Sleet utilized a legitimate code signing certificate issued to CyberLink Corp. to sign the malicious executable,” the company said. “This certificate has been added to Microsoft’s disallowed certificate list to protect customers from future malicious use of the certificate.”
The companies that grab the infected update will get LambLoad, a malware downloader that doesn’t work on devices protected by FireEye, CrowdStrike, or Tanium, Microsoft added. If LambLoad spots none of these endpoint protection tools on the device, it will drop a fake PNG file that deploys the final payload. This payload can steal sensitive data, infiltrate software build environments, progress downstream, establish persistent access, and more.
Since discovering the attack, Microsoft notified both CyberLink and Microsoft Defender for Endpoint customers affected by the campaign. The attack was also reported to GitHub, which removed the stage-two payload.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
CyberLink has been making software since 1996,BleepingComputerreports, and has since sold more than 400 million copies worldwide. The company is currently silent on the matter, as there’s nothing posted on its newsroom site, Facebook, or Twitter profiles.
Microsoft has posted a list of mitigation measures that can be found onthis link.
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Washington state court systems taken offline following cyberattack
Is it still worth using Proton VPN Free?
Target kicks off its Black Friday sale with deals on TVs, toys, iPads, air fryers and more
