A threat group known as Barium is exploiting trusted software updates and apps to conduct a wave of supply chain attacks, which could affect more than 1 million users around the world.

One example of the kind of tools used in the campaign is ASUS Live Update Utility, according to Kaspersky Lab. Over the course of a five-month period starting last June, the threat group used legitimate (but stolen) digital certificates to create Trojan versions of the software, which comes installed on ASUS computers.

Barium is also known as Shadowhammer and several other names, the researchers noted.

Barium’s APT Campaign

Using network adapters’ unique identifiers, otherwise known as media access control (MAC) addresses, the attackers hardcoded tables within the backdoors it created in the utility.

Those who installed the updater would immediately begin a process where the backdoor would check the tables to see if they were one of the several hundred users targeted in the supply chain attack. Only machines that matched indicated any activity on the network, which allowed Barium to fly under the radar for a considerable length of time, the researchers said.

Although they require more technical expertise and sophistication, supply chain attacks are a rising advanced persistent threat (APT). Other examples include the use of tools such as CCleaner, which is designed to remove unwanted files from a desktop computer.

The idea is to look for vendors with a large installed base who inherently trust the vendors in question and whose own infrastructure might otherwise be secure. In fact, researchers detected similar supply chain attacks involving three other Asian software vendors.

Keeping Supply Chain Attacks at Bay

Whether based on software applications or physical parts, a supply chain is only as good as its weakest link, and Barium is hard at work looking for those weak links.

IBM experts suggest performing regular inventories of third parties that might be connected to a network and scanning them for any signs of vulnerability. In some cases, organizations might need to add additional controls or change the process in which those external connections are established and maintained.