Vulnerabilitycritical
North Korea-linked APT Diamond Sleet supply chain attack relies on CyberLink software
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-42793 | Authentication bypass in JetBrains TeamCity enables unauthenticated RCE | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | imgur.com | User-Agent ‘Microsoft Internet Explorer’: hxxps[:]//i.stack.imgur[.]com/NDTUM.png hxxps[:]//www.webville[.]net/images/CL202966126 |
| domain | webville.net | rer’: hxxps[:]//i.stack.imgur[.]com/NDTUM.png hxxps[:]//www.webville[.]net/images/CL202966126.png hxxps[:]//cldownloader.github[.]io |
| url | https://cldownloader.github.io/logo.png | TUM.png hxxps[:]//www.webville[.]net/images/CL202966126.png hxxps[:]//cldownloader.github[.]io/logo.png The PNG file embeds a payload within a deceptive outer |
| url | https://i.stack.imgur.com/NDTUM.png | using the static User-Agent ‘Microsoft Internet Explorer’: hxxps[:]//i.stack.imgur[.]com/NDTUM.png hxxps[:]//www.webville[.]net/images/CL202966126.png hxx |
| url | https://www.webville.net/images/CL202966126.png | Internet Explorer’: hxxps[:]//i.stack.imgur[.]com/NDTUM.png hxxps[:]//www.webville[.]net/images/CL202966126.png hxxps[:]//cldownloader.github[.]io/logo.png The PNG fil |
From the original article
2 min read at securityaffairs.com
North Korea-linked APT group Diamond Sleet is distributing a trojanized version of the CyberLink software in a supply chain attack. Microsoft Threat Intelligence researchers uncovered a supply chain attack carried out by North Korea-linked APT Diamond Sleet (ZINC) involving a trojanized variant of a CyberLink software.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.