Loading story…
Researchers reported that Operation ShadowHammer compromised the ASUS Live Update utility, turning a trusted software update channel into a malware delivery mechanism. The campaign was linked to the broader pattern of software supply chain intrusions seen in incidents such as CCleaner, ShadowPad, NotPetya via M.E.Doc, XcodeGhost, Havex, and the event-stream compromise, where attackers abused legitimate development, build, or distribution processes to reach victims at scale.
Analysis of these attacks highlighted a particularly stealthy technique: tampering with Microsoft Visual C/C++ runtime (CRT) behavior during compilation or linking so malicious code is inserted at build time rather than appearing in source code. In the ShadowPad case, researchers said attackers poisoned the DLL nssock2.dll by abusing the function pointer table used by the CRT routine _initterm(), illustrating how trusted binaries can be backdoored in ways that are difficult to detect. The reports said defenders should prioritize integrity checks across build environments, compiler libraries, third-party components, update infrastructure, and release systems to reduce exposure to similar supply chain compromises.
Trace attribution and downstream blast radius.
13 events from the most recent confirmed update back to the earliest known activity.
A gaming industry attack involving Winnti.A was publicized, describing the compromise of three gaming companies' main executables.
The npm package event-stream was compromised after publishing rights were delegated to another person, who added the malicious flatmap-stream package as a direct dependency to target Copay release build environments and steal bitcoins.
Attackers compromised a computer vendor's update server in Operation ShadowHammer and targeted users based on MAC addresses.
A poisoned MediaGet update delivered a trojanized copy of mediaget.exe.
The CCleaner case involved the compromise of Piriform and the insertion of a backdoor into CCleaner.
Attackers compromised NetSarang Computer, Inc. and backdoored all of the company's products by injecting malicious code into the shared library nssock2.dll.
The Nyetya/NotPetya attack on M.E.Doc used the software's update system to deliver destructive ransomware, including a backdoored .NET module named ZvitPublishedObjects.dll.
A trojanized version of Apple's Xcode IDE was hosted on Chinese file-sharing services, causing iOS apps built with it to become infected.
The KingSlayer attack on EventID compromised both the Windows Event Log Analyzer source code and its update server.
Havex-related compromises of industrial control system websites and software installers also occurred in 2014.
In the Monju incident, attackers compromised the update server for GOM Player and distributed a variant of Gh0st RAT to specific targets.
Multiple industrial control system websites and software installers were compromised in Havex incidents affecting the sector.
The Winnti group targeted the online video game industry by compromising multiple companies' update servers and attempting to spread malicious implants or libraries using AheadLib.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 33 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourcesecurelist.com
Open sourcenorfolkinfosec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised ASUS's **Live Update** infrastructure and used legitimate ASUS digital certificates to distribute a trojanized software update to Windows users in a supply-chain attack dubbed **ShadowHammer**. The malicious update was reportedly delivered between June and November 2018 and reached a large number of systems, with Kaspersky identifying more than 57,000 affected customers and Symantec seeing at least 13,000 among its own users; reporting indicated the broader victim count may have reached into the hundreds of thousands. Researchers said the operation was highly selective despite its broad distribution: the backdoored updater checked hashed **MAC addresses** against an embedded target list and only contacted a command-and-control domain to retrieve a second-stage payload on roughly 600 intended machines. SentinelOne and other researchers described the campaign as a tailored, stealthy supply-chain intrusion linked to activity associated with **ShadowPad** and the **CCleaner** compromise, while criticism mounted over ASUS's response, including allegations that the company was slow to acknowledge the breach and revoke compromised certificates.
Jun 29, 2026
A critical vulnerability, tracked as CVE-2025-59374, was identified in certain versions of the ASUS Live Update client after evidence of active exploitation surfaced. The flaw, which has a CVSS score of 9.3, stems from a supply chain compromise where unauthorized modifications were introduced into the software, allowing attackers to execute unintended actions on targeted devices. The attack, known as Operation ShadowHammer, specifically targeted users based on their network adapters' MAC addresses, with malicious code embedded in trojanized versions of the client distributed between June and November 2018. ASUS addressed the issue in version 3.6.8, and the Live Update client has since reached end-of-support, with the last version being 3.6.15 as of December 2025. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-59374 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the ongoing risk posed by legacy installations. While the vulnerability only affects devices that installed the compromised versions and met specific targeting conditions, organizations are urged to ensure that unsupported versions of the ASUS Live Update client are removed from their environments. No currently supported ASUS products are affected, but the incident underscores the persistent threat of supply chain attacks and the importance of timely software updates and decommissioning of end-of-life software.
Jun 29, 2026
ASUS patched two vulnerabilities in its preinstalled **DriverHub** software that can be chained to achieve unauthenticated remote code execution on affected Windows systems. The flaws, tracked as `CVE-2025-3462` and `CVE-2025-3463`, affect DriverHub versions earlier than **1.0.6.0** and stem from insufficient certificate and origin validation in the utility’s update and installation workflow. Researchers reported that the bugs allow a malicious website to interact with DriverHub through specially crafted HTTP requests and trigger code execution with minimal user interaction. According to public reporting and ASUS’s security advisory, the attack abuses a `driverhub.asus.com.<arbitrary>.com`-style domain to pass validation checks, causing DriverHub to launch `AsusSetup.exe` in silent mode and process a malicious `AsusSetup.ini` file that redirects installation to attacker-controlled code. CSIRT.SK said successful exploitation could fully compromise the confidentiality, integrity, and availability of a victim machine. ASUS has released updates and urged users to upgrade DriverHub immediately to version **1.0.6.0** or later.
Jul 24, 2026