{"id":49709,"date":"2022-12-14T00:00:00","date_gmt":"2022-12-14T00:00:00","guid":{"rendered":"urn:uuid:5736562b-a332-b705-87c9-b0405f73a146"},"modified":"2022-12-14T00:00:00","modified_gmt":"2022-12-14T00:00:00","slug":"probing-weaponized-chat-applications-abused-in-supply-chain-attacks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/probing-weaponized-chat-applications-abused-in-supply-chain-attacks\/","title":{"rendered":"Probing Weaponized Chat Applications Abused in Supply-Chain Attacks"},"content":{"rendered":"

<\/p>\n

<\/div>\n
\n

In late September 2022, threat researchers<\/a> uncovered a supply-chain attack carried out by malicious actors using a trojanized installer of Comm100<\/a>, a chat-based customer engagement application. Our investigation of the incident revealed that the breadth and depth of the campaign\u2019s impact were greater than what the researchers had initially thought; we also found that more applications and their respective versions had been affected and established that attacks began much earlier than their first reckoning on Sept. 29, 2022.<\/p>\n

Data from our telemetry suggested that some versions of a similar customer engagement software, LiveHelp100<\/a> has also been weaponized. LiveHelp100 shares the same office address as Comm100, and both share one director. Findings from our investigation that began on Oct. 14, 2022  indicated that the client application had been loading backdoor scripts from the malicious actor\u2019s infrastructure since Aug. 8, 2022. It is also worth noting that we were able to identify a JavaScript backdoor injected in the web application of LiveHelp100 as early as February 2022. We have sent messages to LiveHelp100 but have received no reply.<\/p>\n

We could not determine, however, if the trojanized versions of LiveHelp100 were delivered using a similar supply-chain attack on its official website as Comm100 because the installers were not available when we were conducting our research. Our telemetry detected requests made by some of LiveHelp100\u2019s clients to load JavaScript backdoors, likely the same ones that we had previously observed in the supply-chain attack on the Comm100 application.  This prompted us to examine the infection chain more closely, enabling us to identify additional pieces of malware that the malicious actors employed in their campaign.<\/p>\n

Interestingly, we also discovered that some of the victims that had been targeted with the more advanced stages of the malware deployment were personnel of online gambling platforms that have access to the administration panel of their respective websites, suggesting that this might also be one of the campaign\u2019s objectives.<\/p>\n

Analysis of JavaScript backdoor<\/b><\/p>\n

The Windows and macOS versions of the LiveHelp100 client application are developed with the Electron.js<\/a> runtime framework. Data from our telemetry revealed two versions of this application, 11.0.2 and 11.0.3, that have been attempting to communicate with the following URL since August 8, 2022:<\/p>\n