Operation ShadowHammerThreat actor
Newly discovered supply chain attack that leveraged ASUS Live Update software. The goal of the attack was to surgically target an unknown pool of users, which were identified by their network adapters’ MAC addresses.From MISP Galaxy
Last reported 7 years ago, by Huntress1 report
What the reports say
1 report, newest first · the exact sentence from each-
Rapid Response: ASUS Live Update Attack (Operation ShadowHammer)“Rapid Response: ASUS Live Update Attack (Operation ShadowHammer)”
Indicators in its reports
named in the reports above- hxxp://liveupdate01.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER365.zipin 1 report
- hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER362.zipin 1 report
- hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER360.zipin 1 report
- hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER359.zipin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.