May 8, 2019 By Shane Schick 2 min read

A threat group known as Barium is exploiting trusted software updates and apps to conduct a wave of supply chain attacks, which could affect more than 1 million users around the world.

One example of the kind of tools used in the campaign is ASUS Live Update Utility, according to Kaspersky Lab. Over the course of a five-month period starting last June, the threat group used legitimate (but stolen) digital certificates to create Trojan versions of the software, which comes installed on ASUS computers.

Barium is also known as Shadowhammer and several other names, the researchers noted.

Barium’s APT Campaign

Using network adapters’ unique identifiers, otherwise known as media access control (MAC) addresses, the attackers hardcoded tables within the backdoors it created in the utility.

Those who installed the updater would immediately begin a process where the backdoor would check the tables to see if they were one of the several hundred users targeted in the supply chain attack. Only machines that matched indicated any activity on the network, which allowed Barium to fly under the radar for a considerable length of time, the researchers said.

Although they require more technical expertise and sophistication, supply chain attacks are a rising advanced persistent threat (APT). Other examples include the use of tools such as CCleaner, which is designed to remove unwanted files from a desktop computer.

The idea is to look for vendors with a large installed base who inherently trust the vendors in question and whose own infrastructure might otherwise be secure. In fact, researchers detected similar supply chain attacks involving three other Asian software vendors.

Keeping Supply Chain Attacks at Bay

Whether based on software applications or physical parts, a supply chain is only as good as its weakest link, and Barium is hard at work looking for those weak links.

IBM experts suggest performing regular inventories of third parties that might be connected to a network and scanning them for any signs of vulnerability. In some cases, organizations might need to add additional controls or change the process in which those external connections are established and maintained.

More from

Exploring the 2024 Worldwide Managed Detection and Response Vendor Assessment

3 min read - Research firm IDC recently released its 2024 Worldwide Managed Detection and Response Vendor Assessment, which both highlights leaders in the market and examines the evolution of MDR as a critical component of IT security infrastructure. Here are the key takeaways. The current state of MDR According to the assessment, “the MDR market has evolved extensively over the past couple of years. This should be seen as a positive movement as MDR providers have had to evolve to meet the growing…

Regulatory harmonization in OT-critical infrastructure faces hurdles

3 min read - In an effort to enhance cyber resilience across critical infrastructure, the Office of the National Cyber Director (ONCD) has recently released a summary of feedback from its 2023 Cybersecurity Regulatory Harmonization Request for Information (RFI). The responses reveal major concerns from critical infrastructure industries related to operational technology (OT), such as energy, transport and manufacturing. Their worries include the current fragmented regulatory landscape and difficulty adapting to new cyber regulations. The frustration appears to be unanimous. Meanwhile, the magnitude of…

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today