The North Koreans are up to no good again. Microsoft is reporting that they have discover a supply chain attack by a group of threat actors named Diamond Sleet who are using a malicious variant of a legitimate CyberLink application installer that has been modified to include malicious code that downloads, decrypts, and loads a second-stage payload:
Microsoft Threat Intelligence has uncovered a supply chain attack by the North Korea-based threat actor Diamond Sleet (ZINC) involving a malicious variant of an application developed by CyberLink Corp., a software company that develops multimedia software products. This malicious file is a legitimate CyberLink application installer that has been modified to include malicious code that downloads, decrypts, and loads a second-stage payload. The file, which was signed using a valid certificate issued to CyberLink Corp., is hosted on legitimate update infrastructure owned by CyberLink and includes checks to limit the time window for execution and evade detection by security products. Thus far, the malicious activity has impacted over 100 devices in multiple countries, including Japan, Taiwan, Canada, and the United States.
Microsoft attributes this activity with high confidence to Diamond Sleet, a North Korean threat actor. The second-stage payload observed in this campaign communicates with infrastructure that has been previously compromised by Diamond Sleet. More recently, Microsoft has observed Diamond Sleet utilizing trojanized open-source and proprietary software to target organizations in information technology, defense, and media.
Ken Westin, Field CISO, Panther Labs had this to say:
North Korean APT groups continue to target the software supply chain because it’s proven to be successful repeatedly, instead of targeting individual systems, they infect software upstream giving them potential access to a larger number of systems. They continue to increase the level of sophistication in these attacks with strong knowledge of the tooling and techniques of modern DevOps teams. Most organizations are not monitoring their DevOps processes for these types of attacks and lack mechanisms to detect when code may be compromised. I predict more threat groups will follow this approach to infect a larger number of systems downstream as well as improve methods to bypass rudimentary security measures.
I encourage you to read the full report as it has a lot of detail as to what you can do to protect yourself from this threat actor. Because this group of North Koreans clearly mean business.
Casetify Gets Called Out By iFixit For Stealing Their Stuff
Posted in Commentary with tags Casetify, dBrand on November 26, 2023 by itnerdThe issues for Casetify when it comes to ripping off other companies designs are mounting. To recap:
At the time that the iFixit discovery was made, I said this:
I’m watching to see how iFixit responds to this. As in do they sue Casetify and add to their misery. But the bottom line is that this not a good look for Casetify if this is accurate. Even if it isn’t (and to be frank, I don’t know how it can’t be accurate), the bad press that this has created means that Casetify is likely heading toward oblivion. To paraphrase Tony Stark from “The Avengers” there is no scenario where Casetify comes out on top of this situation.
Well, iFixit has posted this response on Twitter:
At this point, it isn’t clear if iFixit will sue Casetify. But if I were iFixit I would as this is going to be the easiest case to win as Casetify literally has no defence that they can mount seeing how blatant their actions were.
If I were Casetify, they should throw themselves on the mercy of dBrand and iFixit, along with whomever else they’ve stolen stuff from. Because they are going to get destroyed in court. But not before they get destroyed in the court of public opinion. And neither of those are things that they can recover from.
Leave a comment »