Comm100 is a provider of customer service and communication products that serves over 200,000 businesses. At the time of this writing it is unclear how many customers of the company were impacted by the attack.
The attack took place from at least September 27, 2022 through the morning of September 29, 2022. The malicious installer was used to infect organizations in multiple sectors, including the industrial, healthcare, technology, manufacturing, insurance and telecommunications sectors in North America and Europe.
CrowdStrike researchers assess with moderate confidence that the threat actor behind this supply chain attack likely has a China nexus.
The malicious code was delivered via a signed Comm100 installer that was downloadable from the company’s website
“Malware is delivered via a signed Comm100 installer that was downloadable from the company’s website. The installer was signed on September 26, 2022 at 14:54:00 UTC using a valid Comm100 Network Corporation certificate.” reads a report published by CrowdStrike. “CrowdStrike Intelligence can confirm that the Microsoft Windows 7+ desktop agent hosted at https[:]//dash11.comm100[.]io/livechat/electron/10000/Comm100LiveChat-Setup-win.exe that was available until the morning of September 29 was a trojanized installer.”
Comm100 addressed the issue by releasing a clean, updated installer, version 10.0.9.
“The injected payload connects to the malicious C2 domain api.microsoftfileapis[.]com, which resolved to the IP address 8.219.167[.]156 at the time of the incident.” continues the report.
The attackers used the Microsoft Metadata Merge Utility binary to load a the MidlrtMd DLL.
“Furthermore, CrowdStrike Intelligence assesses with moderate confidence that this actor likely has a China nexus. This assessment is based on the presence of Chinese-language comments in the malware, aforementioned tactics, techniques and procedures (TTPs), and the connection to the targeting of online gambling entities in East and Southeast Asia — a previously established area of focus for China-nexus targeted intrusion actors. CrowdStrike Intelligence customers have access to additional reporting related to this actor.”
The report includes Indicators of Compromise (IoCs) for this attack.
Follow me on Twitter: @securityaffairs and Facebook
(SecurityAffairs – hacking, Comm100)
If you like the site, please consider joining the telegram channel or supporting us on Patreon using the button below.