Tuesday, April 16, 2024

Comm100 Live Chat App Hijacked in Supply Chain Attack to Deliver Malware

As part of a new supply-chain attack being carried out against the Comm100 Live Chat application, the official installer for the application was trojanized.

Comm100 Live Chat application is a popular Canadian SaaS application that is used extensively by businesses to interact with website visitors and to communicate with customers.

The cybersecurity analysts at CrowdStrike claimed that from September 26 to 29 the trojanized variant was available on the vendor’s website.

There was a valid digital signature attached to the trojanized installer. A stealthy supply chain attack would not be disrupted if anti-virus solutions are not triggered during its launch, thus allowing the attack to proceed undetected.

Attack

A Comm100 desktop agent app is downloaded from the company’s website that was signed by Comm100 and was used in the attack.

Currently, it is unknown to what extent the attack was carried out. There is, however, evidence that the trojanized files were identified in North America and Europe in the following sectors:-

  • Industrial
  • Healthcare
  • Technology
  • Manufacturing
  • Insurance
  • Telecom

Over 15,000 customers across 51 countries are said to be served by Comm100.

Backdoor

In the main.js file, a JavaScript backdoor was implanted by the threat actors. During the second stage of the backdoor, a JS script obfuscated by a hard-coded URL is retrieved.

Here’s the hardcoded URL used by the threat actors to download and execute a second-stage script:-

  • http[:]//api.amazonawsreplay[.]com/livehelp/collect

The threat actors have also deployed a malicious loader DLL called MidlrtMd.dll in order to carry out their malicious activities. With the help of this, a new Notepad process (notepad.exe) is injected with an embedded payload by the threat actors through this in-memory shellcode.

Chinese Threat Actors Presumed

Based on CrowdStrike’s assessment, China-based threat actors are responsible for the attack. Previously, this group had been seen to target East and Southeast Asian online gambling enterprises in the past.

These malware families differ from those previously identified as being operated by the group in terms of the payload delivered. It is clear from this that the offensive arsenal of the organization is expanding.

Here below we have mentioned all the factors considered by the security experts to assume that the threat actors could be Chinese:-

  • The use of chat software to deliver malware 
  • The use of the Microsoft Metadata Merge Utility binary to load a malicious DLL named MidlrtMd.dll
  • C2 domain-naming convention using Microsoft and Amazon-themed domains along with api. subdomains 
  • C2 domains hosted on Alibaba infrastructure 

Comm100 has already been informed of the problem by the security experts. Therefore, a clean installer has been released, version 10.0.9 by the developers. It is highly recommended that users update their Live Chat software as soon as possible.

Cyber Attack with Zero Trust Networking – Download Free E-Book

Website

Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles