North Korean Hackers Distribute Trojanized CyberLink Software in Supply Chain Attack

A North Korean condition-sponsored risk actor tracked as Diamond Sleet is distributing a trojanized variation of a respectable application developed by a Taiwanese multimedia application developer known as CyberLink to focus on downstream customers through a offer chain attack.

“This malicious file is a legitimate CyberLink application installer that has been modified to include malicious code that downloads, decrypts, and hundreds a next-phase payload,” the Microsoft Threat Intelligence team explained in an analysis on Wednesday.

The poisoned file, the tech giant reported, is hosted on the up to date infrastructure owned by the business though also such as checks to limit the time window for execution and bypass detection by security products.

The marketing campaign is estimated to have impacted over 100 devices throughout Japan, Taiwan, Canada, and the U.S. Suspicious exercise associated with the modified CyberLink installer file was observed as early as October 20, 2023.

The hyperlinks to North Korea stem from the actuality that the next-stage payload establishes connections with command-and-regulate (C2) servers formerly compromised by the risk actor.

Microsoft even more explained it has observed the attackers making use of trojanized open-supply and proprietary software program to goal companies in facts technology, defense, and media sectors.

Diamond Sleet, which dovetails with clusters dubbed TEMP.Hermit and Labyrinth Chollima, is the moniker assigned to an umbrella team originating from North Korea which is also known as Lazarus Team. It is really regarded to be active given that at the very least 2013.

“Their functions considering that that time are representative of Pyongyang’s endeavours to gather strategic intelligence to benefit North Korean interests,” Google-owned Mandiant pointed out final month. “This actor targets governing administration, defense, telecommunications, and money institutions all over the world.”

Interestingly, Microsoft said it did not detect any hands-on-keyboard exercise on concentrate on environments following the distribution of the tampered installer, which has been codenamed LambLoad.

The weaponized downloader and loader examine the focus on program for the presence of security program from CrowdStrike, FireEye, and Tanium, and if not present, fetch yet another payload from a remote server that masquerades as a PNG file.

“The PNG file consists of an embedded payload inside a pretend outer PNG header that is, carved, decrypted, and launched in memory,” Microsoft stated. Upon execution, the malware additional makes an attempt to get in touch with a reputable-but-compromised domain for the retrieval of further payloads.

The disclosures appear a day after Palo Alto Networks Unit 42 discovered twin strategies architected by North Korean danger actors to distribute malware as portion of fictitious job interviews and receive unauthorized employment with organizations based mostly in the U.S. and other areas of the globe.

Previous thirty day period, Microsoft also implicated Diamond Sleet in the exploitation of a critical security flaw in JetBrains TeamCity (CVE-2023-42793, CVSS score: 9.8) to opportunistically breach susceptible servers and deploy a backdoor regarded as ForestTiger.

Observed this posting attention-grabbing? Comply with us on Twitter  and LinkedIn to examine more special articles we post.

Some pieces of this report are sourced from:
thehackernews.com