Article Details

Microsoft: Lazarus hackers breach CyberLink in supply chain attack. Microsoft says a North Korean hacking group has breached Taiwanese multimedia software company CyberLink and trojanized one of its installers to push malware in a supply chain attack targeting potential victims worldwide. According to Microsoft Threat Intelligence, activity suspected to be linked with the altered CyberLink installer file surfaced as early as October 20, 2023. This trojanized installer has been detected on more than 100 devices across various nations worldwide, including Japan, Taiwan, Canada, and the United States. Microsoft security experts have attributed this supply chain attack with high confidence to a North Korean cyberespionage group tracked by Redmond as Diamond Sleet (aka ZINC, Labyrinth Chollima, and Lazarus). The second-stage payload observed while investigating this attack interacts with infrastructure that the same group of threat actors previously compromised. "Diamond Sleet utilized a legitimate code signing certificate issued to CyberLink Corp. to sign the malicious executable," the company said. "This certificate has been added to Microsoft's disallowed certificate list to protect customers from future malicious use of the certificate." Microsoft tracks the trojanized software and related payloads as LambLoad, a malware downloader and loader. LambLoad targets systems not protected by FireEye, CrowdStrike, or Tanium security software. If these conditions are unmet, the malicious executable continues running without executing the bundled malicious code. However, if the criteria are met, the malware connects with one of three command-and-control (C2) servers to retrieve a second-stage payload concealed within a file posing as a PNG file using the static User-Agent 'Microsoft Internet Explorer.' "The PNG file contains an embedded payload inside a fake outer PNG header that is, carved, decrypted, and launched in memory," Microsoft says. This is a common attack method used by the Lazarus North Korean threat actors, who are known for trojanizing legitimate cryptocurrency software to steal crypto assets. Even though Microsoft has yet to detect hands-on-keyboard activity following LambLoad malware breaches, the Lazarus hackers are known for: After detecting a supply chain attack, Microsoft informed CyberLink and is also notifying Microsoft Defender for Endpoint customers who were affected by the attack. Microsoft also reported the attack to GitHub, which removed the second-stage payload as per its Acceptable Use Policies. A CyberLink spokesperson did not immediately respond to BleepingComputer's request for comment.