Supply chain attack on Cyberlink software

BoerenkoolMetWorst · Dec 2, 2023

Diamond Sleet supply chain compromise distributes a modified CyberLink installer

Microsoft Threat Intelligence has uncovered a supply chain attack by the North Korea-based threat actor Diamond Sleet (ZINC) involving a malicious variant of an application developed by CyberLink Corp., a software company that develops multimedia software products. This malicious file is a legitimate CyberLink application installer that has been modified to include malicious code that downloads, decrypts, and loads a second-stage payload. The file, which was signed using a valid certificate issued to CyberLink Corp., is hosted on legitimate update infrastructure owned by CyberLink and includes checks to limit the time window for execution and evade detection by security products. Thus far, the malicious activity has impacted over 100 devices in multiple countries, including Japan, Taiwan, Canada, and the United States.
Click to expand...

https://www.microsoft.com/en-us/sec...e-distributes-a-modified-cyberlink-installer/
(Emphasis by me.)

Rasheed187 · Dec 3, 2023

Yes read about it, quite shocking stuff. That's why I keep saying to never trust any app! I also wonder if it was able to bypass AV's, I wouldn't be surprised if this was the case. That's why it's never a bad idea to install extra protection tools, like anti-loggers and dedicated anti-ransomware, in other words, behavior blocking is the way to go.

Rasheed187 · Dec 3, 2023

North Korea-backed hackers target CyberLink users in supply-chain attack

The file is hosted on legitimate update infrastructure owned by CyberLink, according to Microsoft, and the attackers used a legitimate code signing certificate issued to CyberLink to sign the malicious executable, according to Microsoft. “This certificate has been added to Microsoft’s disallowed certificate list to protect customers from future malicious use of the certificate,” said Microsoft’s Threat Intelligence team.
Click to expand...

https://techcrunch.com/2023/11/22/n...arget-cyberlink-users-in-supply-chain-attack/

Log in or Sign up

Supply chain attack on Cyberlink software

BoerenkoolMetWorst Registered Member

Rasheed187 Registered Member

Rasheed187 Registered Member

Log in or Sign up

Supply chain attack on Cyberlink software

BoerenkoolMetWorst Registered Member

Rasheed187 Registered Member

Rasheed187 Registered Member

Useful Searches