Microsoft’s threat intelligence team has uncovered a supply chain attack by the North Korea-based threat actor involving a malicious variant of an application developed by CyberLink, a Taiwanese company that develops multimedia software products.
This malicious file is a legitimate CyberLink application installer that has been modified to include malicious code that downloads, decrypts and loads a second-stage payload.
The malicious activity has impacted over 100 devices in multiple countries, including Japan, Taiwan, Canada, and the US.
Microsoft attributed this activity with “high confidence to Diamond Sleet, a North Korean threat actor”.
According to CyberLink’s website, it owns over 200 patented technologies and has shipped more than 400 million apps worldwide.
More recently, Microsoft has observed Diamond Sleet utilizing trojanized open-source and proprietary software to target organizations in information technology, defense, and media.
The tech giant said it has communicated this supply chain compromise to CyberLink and is notifying Microsoft Defender for Endpoint customers that have been targeted or compromised in this campaign.
Microsoft reported the attack to GitHub, which removed the second-stage payload in accordance with its acceptable use policies.
“Diamond Sleet focuses on espionage, theft of personal and corporate data, financial gain, and corporate network destruction. Diamond Sleet is known to use a variety of custom malware that is exclusive to the group,” said the team.
Microsoft advised people to take immediate action to address malicious activity on the impacted device.
“If malicious code has been launched, the attacker has likely taken complete control of the device. Immediately isolate the system and perform a reset of credentials and tokens,” said the company.
