North Korean state-sponsored hacking group Diamond Sleet compromised over 100 devices in multiple countries via supply chain compromise · 20.10.2023
Diamond Sleet, a North Korean state-sponsored hacking group, conducted a supply chain attack involving a malicious variant of an application provided by CyberLink Corp., a software company that develops multimedia software products. The file is a functional CyberLink application installer which contains malicious code that downloads, decrypts, and loads a second-stage payload. The file is also signed using a valid certificate issued to CyberLink and is also hosted on update infrastructure owned by CyberLink. So far, the malicious file is installed on at least 100 devices in multiple countries, including Japan, Taiwan, Canada, and the United States.
Diamond Sleet supply chain compromise distributes a modified CyberLink installer · 2023-10
Diamond Sleet supply chain compromise distributes a modified CyberLink installer
https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/
CyberLink installer supply-chain attack (Nov 2023), attributed to Lazarus / APT38 · 2023년 하반기
Cyber-Link 2023.11 DPRK Lazarus, APT38 • 대만 멀티미디어 소프트웨어 CyberLink에서 탈 취한 인증서로 인증한 다운로더 악성코드가 주입 된 CyberLink 설치 프로그램(LambLoad) 배포 • 일본, 대만, 캐나다, 미국 등 국가에서 100개 이 상의 장치에 영향 [KISA report, page 28]
Diamond Sleet supply chain compromise distributes a modified CyberLink installer | Microsoft Security Blog · November
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 55 of 75, PDF p. 329). DPRK cyber actor: Lazarus; Report Name: Diamond Sleet supply chain compromise distributes a modified CyberLink installer | Microsoft Security Blog; Case Summary: Lazarus modified a legitimate CyberLink application installer, hosted on legitimate CyberLink infrastructure and signed using a legitimate CyberLink certificate, to include malicious code. The malicious activity has impacted over 100 devices in multiple jurisdictions, including a number of countries in East Asia and North America.; Publication Month: November
CyberLink installer supply chain attack (over 100 devices)
Para 138: “The Lazarus Group conducted a supply chain attack involving a malicious variant of an application developed by CyberLink Corp., in which malicious code was inserted into a legitimate CyberLink application installer, hosted on legitimate CyberLink infrastructure and signed using a legitimate CyberLink certificate, affecting over 100 devices in multiple jurisdictions.”
Diamond Sleet supply chain compromise distributing a modified CyberLink installer · 2023-11-22T17:00:00+00:00 (published_time)
Microsoft Threat Intelligence has uncovered a supply chain attack by the North Korea-based threat actor Diamond Sleet (ZINC) involving a malicious variant of an application developed by CyberLink Corp., a software company that develops multimedia software products. ... Thus far, the malicious activity has impacted over 100 devices in multiple countries, including Japan, Taiwan, Canada, and the United States. ... Microsoft has observed suspicious activity associated with the modified CyberLink installer file as early as October 20, 2023.
Diamond Sleet Distributes Modified CyberLink Installer in Supply Chain Compromise · 2023-11-27T17:40:02+00:00
Beginning on at least October 20, 2023, a North Korea-linked threat actor, tracked as Diamond Sleet by Microsoft, leveraged a modified CyberLink installer to compromise victim assets.