Microsoft claims CyberLink has been breached by North Korean hackers

Representational image of a hacker
(Image credit: Shutterstock)

North Korean hackers appear to be drawing inspiration from their Russian counterparts following new reports of a major supply chain attack not unlike the notorious 2020 Solarwinds hack.

Microsoft security researchers have claimed Lazarus Group (AKA Diamond Sleet), an infamous North Korean state-sponsored threat actor, breached the networks of CyberLink, a known multimedia company from Taiwan. 

The group used this privilege to infect one of CyberLink’s installers with malware, resulting in infections wherever the software was updated.

Reader Offer: $50 Amazon gift card with demo

Reader Offer: $50 Amazon gift card with demo
Perimeter 81's Malware Protection intercepts threats at the delivery stage to prevent known malware, polymorphic attacks, zero-day exploits, and more. Let your people use the web freely without risking data and network security.

Preferred partner (What does this mean?


Earliest signs of the attack point to late October 2023, Microsoft's report said, with at least 100 endpoints have been compromised, located everywhere from Japan and Taiwan, to Canada and the United States. 

"Diamond Sleet utilized a legitimate code signing certificate issued to CyberLink Corp. to sign the malicious executable," the company said. "This certificate has been added to Microsoft's disallowed certificate list to protect customers from future malicious use of the certificate."

The companies that grab the infected update will get LambLoad, a malware downloader that doesn’t work on devices protected by FireEye, CrowdStrike, or Tanium, Microsoft added. If LambLoad spots none of these endpoint protection tools on the device, it will drop a fake PNG file that deploys the final payload. This payload can steal sensitive data, infiltrate software build environments, progress downstream, establish persistent access, and more.

Since discovering the attack, Microsoft notified both CyberLink and Microsoft Defender for Endpoint customers affected by the campaign. The attack was also reported to GitHub, which removed the stage-two payload. 

CyberLink has been making software since 1996, BleepingComputer reports, and has since sold more than 400 million copies worldwide. The company is currently silent on the matter, as there’s nothing posted on its newsroom site, Facebook, or Twitter profiles. 

Microsoft has posted a list of mitigation measures that can be found on this link

More from TechRadar Pro

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.