\n<\/p>\n
North Korean state-backed hackers are distributing a malicious version of a legitimate application developed by CyberLink, a Taiwanese software maker, to target downstream customers.<\/p>\n
Microsoft\u2019s Threat Intelligence team said<\/a> on Wednesday North Korean hackers had compromised CyberLink to distribute a modified installer file from the company as part of a wide-reaching supply-chain attack.\u00a0<\/span><\/p>\n CyberLink is a software company headquartered in Taiwan that develops multimedia software, such as PowerDVD,\u00a0<\/span>and AI facial recognition technology. According to the company\u2019s website<\/a>, CyberLink owns over 200 patented technologies and has shipped more than 400 million apps worldwide. \u00a0<\/span><\/p>\n Microsoft said it observed suspicious activity associated with the modified CyberLink installer, tracked by the company as \u201cLambLoad,\u201d as early as October 20, 2023.\u00a0<\/span>It has so far detected the trojanized installer on more than 100 devices in multiple countries, including Japan, Taiwan, Canada and the United States.<\/p>\n The file is hosted on legitimate update infrastructure owned by CyberLink, according to Microsoft, and the attackers used a legitimate code signing certificate issued to CyberLink to sign the malicious executable, according to Microsoft.\u00a0<\/span>\u201cThis certificate has been added to Microsoft\u2019s disallowed certificate list<\/a> to protect customers from future malicious use of the certificate,\u201d said Microsoft\u2019s Threat Intelligence team.<\/p>\n The company noted that a second-phase payload observed in this campaign interacts with infrastructure previously compromised by the same group of threat actors.<\/p>\n Microsoft has attributed this attack with \u201chigh confidence\u201d to a group it tracks as Diamond Sleet, a North Korean nation-state actor linked to the notorious Lazarus hacking group<\/a>. This group has been observed targeting organizations in information technology, defense and media. And it focuses predominantly on espionage, financial gain and corporate network destruction, according to Microsoft.\u00a0<\/span><\/p>\n Microsoft said it has yet to detect hands-on keyboard activity but noted that Diamond Sleet attackers commonly steal data from compromised systems, infiltrate software build environments, progress downstream to exploit further victims and attempt to gain persistent access to victims\u2019 environments.<\/p>\n Microsoft said it notified CyberLink of the supply-chain compromise but did not say whether it had received a response or whether CyberLink had taken any action in light of the company\u2019s findings. The company is also notifying Microsoft Defender for Endpoint customers who were affected by the attack.<\/p>\n