Poisoned Pipeline / Incidents / AS62
Operation ShadowHammer (ASUS Live Update)
Windows softwareInstaller / update channel
Between June and November 2018 attackers replaced ASUS Live Update
packages on the official liveupdate01[s].asus.com servers with
backdoored builds signed with legitimate ASUSTeK certificates. Kaspersky
(Securelist, March 2019) reported more than 57,000 of its customers had
installed a backdoored updater; the real target set was a hardcoded list
of 600+ MAC addresses. Related to the 2017 ShadowPad / BARIUM / Winnti
cluster (see also AS5 CCleaner). Surgical supply-chain via a vendor
update channel, not a public language registry.
Mapped techniques
- T0121 Compromised legitimate artifact
- T0209 Compromise package registry or CDN origin
- T0208 Compromise code-signing identity
- T0138 Backdoor in code
- T0159 Malicious artifact execution
supply-chain signed vendor updater backdoor
Official ASUS Live Update packages replaced on ASUS servers.
liveupdate01[s].asus.com origin hosted the trojanized zips.
Binaries signed with legitimate ASUSTeK Computer Inc. certificates.
MAC-filtered backdoor; ~600 hardcoded adapter addresses.
Preinstalled updater ran the signed payload as a trusted update.