Social News XYZ     

N.Korean hackers target CyberLink users in supply chain attack: Microsoft

N.Korean hackers target CyberLink users in supply chain attack: Microsoft

San Francisco, Nov 23 (SocialNews.XYZ) Microsoft’s threat intelligence team has uncovered a supply chain attack by the North Korea-based threat actor involving a malicious variant of an application developed by CyberLink, a Taiwanese company that develops multimedia software products.

This malicious file is a legitimate CyberLink application installer that has been modified to include malicious code that downloads, decrypts, and loads a second-stage payload.

 

The malicious activity has impacted over 100 devices in multiple countries, including Japan, Taiwan, Canada, and the US.

Microsoft attributed this activity with “high confidence to Diamond Sleet, a North Korean threat actor”.

According to CyberLink’s website, it owns over 200 patented technologies and has shipped more than 400 million apps worldwide.

More recently, Microsoft has observed Diamond Sleet utilising trojanised open-source and proprietary software to target organisations in information technology, defense and media.

The tech giant said it has communicated this supply chain compromise to CyberLink and is notifying Microsoft Defender for Endpoint customers that have been targeted or compromised in this campaign.

Microsoft reported the attack to GitHub, which removed the second-stage payload in accordance with its acceptable use policies.

“Diamond Sleet focuses on espionage, theft of personal and corporate data, financial gain, and corporate network destruction. Diamond Sleet is known to use a variety of custom malware that is exclusive to the group,” said the team.

Microsoft advised people to take immediate action to address malicious activity on the impacted device.

“If malicious code has been launched, the attacker has likely taken complete control of the device. Immediately isolate the system and perform a reset of credentials and tokens,” said the company.

Source: IANS

Facebook Comments
N.Korean hackers target CyberLink users in supply chain attack: Microsoft

About Gopi

Gopi Adusumilli is a Programmer. He is the editor of SocialNews.XYZ and President of AGK Fire Inc.

He enjoys designing websites, developing mobile applications and publishing news articles on current events from various authenticated news sources.

When it comes to writing he likes to write about current world politics and Indian Movies. His future plans include developing SocialNews.XYZ into a News website that has no bias or judgment towards any.

He can be reached at gopi@socialnews.xyz

%d bloggers like this: