The National Cyber Security Centre (NCSC) and Korea’s National Intelligence Service (NIS) jointly warned about the North Korea-linked Lazarus hacking group exploiting a zero-day vulnerability in the MagicLine4NX software, developed by South Korean company Dream Security. This joint certificate program, facilitating logins and digital transactions, has become a target for supply-chain attacks.
The attackers utilized the zero-day vulnerability to compromise security authentication and network-linked systems, gaining unauthorized access to the intranet of a target organization. The report reveals a sophisticated attack chain initiated with a watering hole attack, compromising a media outlet’s website. Malicious scripts deployed in a specific article targeted users employing the MagicLine4NX authentication software, granting complete control to the threat actors.
The state-sponsored hackers, primarily targeting South Korean entities, then accessed an internet-side server, spreading malicious code through the network-linked system. The attack aimed to infiltrate business-side servers for data theft. Although the security policy of the solution blocked further data leakage, the potential impact could have been severe.
The report underscores the Lazarus group’s focus on supply-chain attacks, citing a previous incident in March 2023 involving the Labyrinth Chollima APT targeting VoIP software maker 3CX. Additionally, recent observations by SentinelOne revealed behavioral detections of 3CXDesktopApp, indicating a supply chain attack impacting multiple cybersecurity vendors’ products.
Microsoft Threat Intelligence researchers also disclosed a supply chain attack by the North Korea-linked APT Diamond Sleet (ZINC), involving a trojanized variant of a CyberLink software. The attackers signed the malicious code with a valid certificate issued to CyberLink Corp., impacting over 100 devices across multiple countries.
Recommendations
- Regularly update and patch software to address known vulnerabilities.
- Monitor for behavioral anomalies and suspicious activity on networks and systems.
- Educate users on the risks of visiting compromised websites and the importance of updating software.
- Implement network segmentation to limit lateral movement in case of a breach.
- Conduct thorough security audits and assessments to identify and address vulnerabilities.
- Employ advanced threat detection and response solutions to identify and mitigate supply chain attacks.
- Collaborate with cybersecurity vendors and organizations to share threat intelligence and enhance collective defense.