Subj : Microsoft claims CyberLink has been breached by North Korean hack To : All From : TechnologyDaily Date : Thu Nov 23 2023 12:30:06 Microsoft claims CyberLink has been breached by North Korean hackers Date: Thu, 23 Nov 2023 12:17:03 +0000 Description: Supply chain attack saw CyberLink software abused to drop malware, Microsoft reveals. FULL STORY ====================================================================== North Korean hackers appear to be drawing inspiration from their Russian counterparts following new reports of a major supply chain attack not unlike the notorious 2020 Solarwinds hack. Microsoft security researchers have claimed Lazarus Group (AKA Diamond Sleet), an infamous North Korean state-sponsored threat actor, breached the networks of CyberLink, a known multimedia company from Taiwan. The group used this privilege to infect one of CyberLinks installers with malware , resulting in infections wherever the software was updated. Reader Offer: $50 Amazon gift card with demo Perimeter 81's Malware Protection intercepts threats at the delivery stage to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security. Preferred partner ( What does this mean? ) LambLoad Earliest signs of the attack point to late October 2023, Microsoft's report said, with at least 100 endpoints have been compromised, located everywhere from Japan and Taiwan, to Canada and the United States. "Diamond Sleet utilized a legitimate code signing certificate issued to CyberLink Corp. to sign the malicious executable," the company said. "This certificate has been added to Microsoft's disallowed certificate list to protect customers from future malicious use of the certificate." The companies that grab the infected update will get LambLoad, a malware downloader that doesnt work on devices protected by FireEye, CrowdStrike, or Tanium, Microsoft added. If LambLoad spots none of these endpoint protection tools on the device, it will drop a fake PNG file that deploys the final payload. This payload can steal sensitive data, infiltrate software build environments, progress downstream, establish persistent access, and more. Since discovering the attack, Microsoft notified both CyberLink and Microsoft Defender for Endpoint customers affected by the campaign. The attack was also reported to GitHub, which removed the stage-two payload. CyberLink has been making software since 1996, BleepingComputer reports, and has since sold more than 400 million copies worldwide. The company is currently silent on the matter, as theres nothing posted on its newsroom site, Facebook, or Twitter profiles. Microsoft has posted a list of mitigation measures that can be found on this link . More from TechRadar Pro US government, thousands of businesses now thought to have been affected by SolarWinds security attack Here's a list of the best firewalls around today These are the best endpoint security tools right now ====================================================================== Link to news story: https://www.techradar.com/pro/security/microsoft-says-cyberlink-has-been-breac hed-by-north-korean-hackers --- Mystic BBS v1.12 A47 (Linux/64) * Origin: tqwNet Technology News (1337:1/100) .