Few interesting bits that are buried at the very end of the article and many might have missed it: >They said they found similarities between the ASUS attack a

Few interesting bits that are buried at the very end of the article and many might have missed it: >They said they found similarities between the ASUS attack and ones previously conducted by a group dubbed ShadowPad by Kaspersky. ShadowPad targeted a Korean company that makes enterprise software for administering servers; the same group was also linked to the CCleaner attack. Although millions of machines were infected with the malicious CCleaner software update, only a subset of these got targeted with a second stage backdoor, similar to the ASUS victims. Notably, ASUS systems themselves were on the targeted CCleaner list. >The Kaspersky researchers believe the ShadowHammer attackers were behind the ShadowPad and CCleaner attacks and obtained access to the ASUS servers through the latter attack. >“ASUS was one of the primary targets of the CCleaner attack,” Raiu said. “One of the possibilities we are taking into account is that’s how they intially got into the ASUS network and then later through persistence they managed to leverage the access … to launch the ASUS attack.” These attackers have planned this for a very long time. CCleaner was just collateral damage in NSA's quest to infiltrate high-value OEM targets. The NSA probably also got HDD firmware source code and certificates through a similar "shotgun" approach. I also found this part interesting (from [0]): >Although precise attribution is not available at the moment, certain evidence we have collected allows us to link this attack to the ShadowPad incident from 2017. The actor behind the ShadowPad incident has been publicly identified by Microsoft in court documents as BARIUM. BARIUM is an APT actor known to be using the Winnti backdoor. Recently, our colleagues from ESET wrote about another supply chain attack in which BARIUM was also involved, that we believe is connected to this case as well. Which leads to a copy of the lawsuit filed by Microsoft against BARIUM actors [1]. I wonder what the status of this lawsuit is when the defendants are probably the NSA employees. Even Microsoft gives lots of hints about BARIUM being the NSA. They even filed it in Eastern District of Virginia, Alexandria Division, Federal Court... which is one of the favorite places where intelligence agencies file criminal complaints. I bet the US Gov will stonewall and ask the MS to drop it. [0] https://securelist.com/operation-shadowhammer/89992/ https://securelist.com/operation-shadowhammer/89992/ [1] https://www.courthousenews.com/wp-content/uploads/2017/11/barium.pdf https://www.courthousenews.com/wp-content/uploads/2017/11/ba...