Loading story…
Attackers compromised ASUS's Live Update infrastructure and used legitimate ASUS digital certificates to distribute a trojanized software update to Windows users in a supply-chain attack dubbed ShadowHammer. The malicious update was reportedly delivered between June and November 2018 and reached a large number of systems, with Kaspersky identifying more than 57,000 affected customers and Symantec seeing at least 13,000 among its own users; reporting indicated the broader victim count may have reached into the hundreds of thousands.
Researchers said the operation was highly selective despite its broad distribution: the backdoored updater checked hashed MAC addresses against an embedded target list and only contacted a command-and-control domain to retrieve a second-stage payload on roughly 600 intended machines. SentinelOne and other researchers described the campaign as a tailored, stealthy supply-chain intrusion linked to activity associated with ShadowPad and the CCleaner compromise, while criticism mounted over ASUS's response, including allegations that the company was slow to acknowledge the breach and revoke compromised certificates.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
SentinelOne released additional public analysis of the ASUS ShadowHammer operation, describing it as a tailored supply-chain attack. The publication expanded technical understanding of the campaign after the initial disclosures.
At the time of public reporting, Kaspersky said ASUS had denied the compromise, responded slowly, and had not promptly revoked the compromised certificates. This added detail clarified the vendor-response aspect of the incident.
Security researchers at Kaspersky disclosed the ASUS supply-chain attack and named it ShadowHammer, while Symantec independently confirmed the activity. Kaspersky said more than 57,000 of its customers were affected, and Symantec said at least 13,000 of its customers received the malicious update.
Between June and November 2018, ASUS Live Update delivered backdoored updates to a large number of Windows systems. The malware selectively checked hashed MAC addresses to identify roughly 600 intended targets before attempting to retrieve a second-stage payload.
Attackers breached ASUS's software update infrastructure and abused legitimate ASUS digital certificates to prepare trojanized Live Update packages for distribution. Researchers later linked the operation to the ShadowHammer supply-chain campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Operation ShadowHammer** compromised the ASUS Live Update utility, turning a trusted software update channel into a malware delivery mechanism. The campaign was linked to the broader pattern of software supply chain intrusions seen in incidents such as **CCleaner**, **ShadowPad**, **NotPetya via M.E.Doc**, **XcodeGhost**, **Havex**, and the `event-stream` compromise, where attackers abused legitimate development, build, or distribution processes to reach victims at scale. Analysis of these attacks highlighted a particularly stealthy technique: tampering with Microsoft Visual C/C++ runtime (**CRT**) behavior during compilation or linking so malicious code is inserted at build time rather than appearing in source code. In the ShadowPad case, researchers said attackers poisoned the DLL `nssock2.dll` by abusing the function pointer table used by the CRT routine `_initterm()`, illustrating how trusted binaries can be backdoored in ways that are difficult to detect. The reports said defenders should prioritize integrity checks across build environments, compiler libraries, third-party components, update infrastructure, and release systems to reduce exposure to similar supply chain compromises.
Aug 15, 2026
A critical vulnerability, tracked as CVE-2025-59374, was identified in certain versions of the ASUS Live Update client after evidence of active exploitation surfaced. The flaw, which has a CVSS score of 9.3, stems from a supply chain compromise where unauthorized modifications were introduced into the software, allowing attackers to execute unintended actions on targeted devices. The attack, known as Operation ShadowHammer, specifically targeted users based on their network adapters' MAC addresses, with malicious code embedded in trojanized versions of the client distributed between June and November 2018. ASUS addressed the issue in version 3.6.8, and the Live Update client has since reached end-of-support, with the last version being 3.6.15 as of December 2025. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-59374 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the ongoing risk posed by legacy installations. While the vulnerability only affects devices that installed the compromised versions and met specific targeting conditions, organizations are urged to ensure that unsupported versions of the ASUS Live Update client are removed from their environments. No currently supported ASUS products are affected, but the incident underscores the persistent threat of supply chain attacks and the importance of timely software updates and decommissioning of end-of-life software.
Jun 29, 2026
Researchers have tied **ShadowPad**, a modular malware platform sold privately rather than shared openly, to multiple high-profile espionage operations and supply-chain compromises. Analysis indicates the backdoor emerged as a successor to `PlugX` and has been used by several China-linked activity clusters, including subgroups associated with **APT41** as well as actors previously linked to **Axiom**. Investigators say ShadowPad’s architecture allows its developer to restrict plugin access per customer, helping multiple espionage teams reuse the same malware while complicating attribution and lowering development costs for operators. ShadowPad has surfaced in several notable intrusions, including the **CCleaner** compromise, where a trojanized installer reached about **2.27 million** users but a second-stage payload was delivered to only **40** selected systems; investigators also found ShadowPad on Piriform machines with decrypted logs showing **keylogging** activity. It was also linked to **Operation ShadowHammer**, in which attackers trojanized **ASUS Live Update** binaries that retained valid ASUSTeK signatures and selectively activated only on devices whose network-adapter `MAC` addresses matched hardcoded target lists before contacting `asushotfix[.]com` for a second stage. Reporting also connects related activity to compromises involving **NetSarang**, corporate networks, and Asian gaming-sector targets, reinforcing ShadowPad’s role as a recurring tool in selective, supply-chain-enabled Chinese espionage.
Aug 15, 2026