Microsoft claims CyberLink has been breached by North Korean hackers

North Korean hackers appear to be drawing inspiration from their Russian counterparts following new reports of a major supply chain attack not unlike the notorious 2020 Solarwinds hack.

Microsoft security researchers have claimed Lazarus Group (AKA Diamond Sleet), an infamous North Korean state-sponsored threat actor, breached the networks of CyberLink, a known multimedia company from Taiwan. 

The group used this privilege to infect one of CyberLink’s installers with malware, resulting in infections wherever the software was updated.

Reader Offer: $50 Amazon gift card with demo
Perimeter 81's Malware Protection intercepts threats at the delivery stage to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security.

Preferred partner (What does this mean?) 

LambLoad

Earliest signs of the attack point to late October 2023, Microsoft's report said, with at least 100 endpoints have been compromised, located everywhere from Japan and Taiwan, to Canada and the United States. 

"Diamond Sleet utilized a legitimate code signing certificate issued to CyberLink Corp. to sign the malicious executable," the company said. "This certificate has been added to Microsoft's disallowed certificate list to protect customers from future malicious use of the certificate."

The companies that grab the infected update will get LambLoad, a malware downloader that doesn’t work on devices protected by FireEye, CrowdStrike, or Tanium, Microsoft added. If LambLoad spots none of these endpoint protection tools on the device, it will drop a fake PNG file that deploys the final payload. This payload can steal sensitive data, infiltrate software build environments, progress downstream, establish persistent access, and more.

Since discovering the attack, Microsoft notified both CyberLink and Microsoft Defender for Endpoint customers affected by the campaign. The attack was also reported to GitHub, which removed the stage-two payload. 

CyberLink has been making software since 1996, BleepingComputer reports, and has since sold more than 400 million copies worldwide. The company is currently silent on the matter, as there’s nothing posted on its newsroom site, Facebook, or Twitter profiles. 

Microsoft has posted a list of mitigation measures that can be found on this link. 

More from TechRadar Pro

• US government, thousands of businesses now thought to have been affected by SolarWinds security attack
• Here's a list of the best firewalls around today
• These are the best endpoint security tools right now