Microsoft says a North Korean hacking group has breached Taiwanese multimedia software company CyberLink and trojanized one of its installers to push malware in a supply chain attack targeting potential victims worldwide. According to Microsoft Threat Intelligence, activity suspected to be linked with the altered CyberLink installer file surfaced as early as October 20, 2023. Microsoft security experts have attributed this supply chain attack with high confidence to a North Korean cyberespionage group tracked by Redmond as Diamond Sleet. The second-stage payload observed while investigating this attack interacts with infrastructure that the same group of threat actors previously compromised. "Diamond Sleet utilized a legitimate code signing certificate issued to CyberLink Corp. to sign the malicious executable," the company said. "This certificate has been added to Microsoft's disallowed certificate list to protect customers from future malicious use of the certificate." Microsoft tracks the trojanized software and related payloads as LambLoad, a malware downloader and loader. If the criteria are met, the malware connects with one of three command-and-control servers to retrieve a second-stage payload concealed within a file posing as a PNG file using the static User-Agent 'Microsoft Internet Explorer. "The PNG file contains an embedded payload inside a fake outer PNG header that is, carved, decrypted, and launched in memory," Microsoft says. This is a common attack method used by the Lazarus North Korean threat actors, who are known for trojanizing legitimate cryptocurrency software to steal crypto assets. After detecting a supply chain attack, Microsoft informed CyberLink and is also notifying Microsoft Defender for Endpoint customers who were affected by the attack. Microsoft also reported the attack to GitHub, which removed the second-stage payload as per its Acceptable Use Policies. The Lazarus Group is a North Korean-sponsored hacking group that has been operating for more than ten years, since at least 2009. Known for targeting organizations worldwide, their operations have so far included attacks on financial institutions, media outlets, and government agencies. Lazarus has been linked to a wide range of malicious activities encompassing espionage, data breaches, and financial exploitation. The group is thought to be behind many high-profile cyber attacks, including the 2014 Sony Pictures hack, the WannaCry ransomware attack of 2017, and the largest crypto hack ever in 2022. Lazarus hackers breached dev repeatedly to deploy SIGNBT malware. BlueNoroff hackers backdoor Macs with new ObjCShellz malware. North Korean hackers exploit critical TeamCity flaw to breach networks. MATA malware framework exploits EDR in attacks on defense firms.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 30 Nov 2023 23:19:27 +0000