New Malware: ShadowHammer
|by Alpha Team
A supply chain attack on ASUS computers has affected over 1 million of the machines, according to a report from Kaspersky researchers released on March 25. The attack took place between June and November 2018 and affected a wide number of ASUS users, who were targeted based on their specific MAC addresses. Kaspersky believes evidence points to the ShadowPad attack incident from 2017, in which Microsoft publicly attributed to the BARIUM APT actor.
Recommendations:
- Blacklist network infrastructure associated with this campaign
- Make sure defensive systems are updated with the latest detections
- ASUS users can check if their device has been targeted by this campaign on Kaspersky’s website
Details
Although the investigation is still ongoing, Kaspersky has so far stated the attack involves the ASUS Live Update Utility, which is a utility pre-installed on most ASUS computers and used to update certain components. The hackers used an old ASUS update file, injected it with malicious code, and then signed with a legitimate certificate from ASUS, which allowed the campaign to go undetected for several months.
Kasperksy identified specific ASUS users that were targeted based on a hardcoded list of MAC addresses in the trojan, which was used to identify intended targets of the campaign. The researchers identified 600 unique MAC addresses based on 200 samples. However, the researchers did not identify a specific group targeted by this malware, predicting the total distribution of victims should match the distribution of ASUS users.
Kaspersky notified ASUS of this campaign at the end of January 2019.
Indicators of Compromise
Infrastructure:
asushotfix[.]com
141.105.71[.]116
hxxp://liveupdate01.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER365.zip
hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER362.zip
hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER360.zip
hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER359.zip
Hashes:
aa15eb28292321b586c27d8401703494
bebb16193e4b80f4bc053e4fa818aa4e2832885392469cd5b8ace5cec7e4ca19
Tags: malware, all industries, global