A new attack had a mission to distribute crypto-mining malware by compromising the software supplying partner of an application developer.
The multi-tier attack would compromise the shared infrastructure between a PDF editor vendor and one of its partners that provided additional font packages for the application.
“Unknown attackers compromised the shared infrastructure in place between the vendor of a PDF editor application and one of its software vendor partners, making the app’s legitimate installer the unsuspecting carrier of a malicious payload,” Microsoft researchers said in a post. “The attack seemed like just another example of how cybercriminals can sneak in malware using everyday normal processes.”
The compromise appeared to be active between January and March, and could have had an impact on six other vendors working with the font package provider, Microsoft researchers said.
Carried out silently, at first the attack appeared as a typical infection and was automatically blocked, but then the same infection pattern was observed across a larger amount of computers.
Windows Defender APT eventually alerted on nearly 70,000 incidents involving a coin mining process masquerading as pagefile.sys, launched by a service named xbox-service.exe, Microsoft researchers said.
Microsoft’s investigation found a malicious installer package (MSI) was being downloaded by a PDF editor during installation, along with other legitimate installers. Researchers then found out the application vendor itself hadn’t been compromised, but the malicious package was served by a partner that creates and distributes additional font packages used by the app.
The attackers discovered a weakness in the interactions between the app vendor and its partner and also found a way to leverage it to hijack the installation chain of the MSI font packages, thus turning the PDF editor into the unexpected carrier of the malicious payload.
Microsoft discovered the attackers had created a replica of the software partner’s infrastructure on their own server and copied and hosted all MSI files, including font packages, there. They only modified an Asian fonts package to add the malicious payload to it.
The attackers also managed to influence the download parameters used by the PDF app so as to point to their server, which resulted in the download of MSI font packages from the rogue server. Thus, users ended up installing the coin miner malware along with the legitimate application.
At device restart, the malicious MSI file would be replaced with the legitimate version. Microsoft also discovered hardcoded PDF app names in the malicious package and concluded at least six additional vendors might have been targeted by the attackers.
“While we were not able to find evidence that these other vendors distributed the malicious MSI, the attackers were clearly operating with a broader distribution plot in mind,” Microsoft researchers said.
Detected as Trojan:Win64/CoinMiner, the malicious miner would hide behind the name xbox-service.exe and use the infected machine’s resources to mine for Monero. The malware also attempts to prevent remote cleaning and remediation by blocking communication with the update servers of certain PDF apps.
“This new supply chain incident did not appear to involve nation-state attackers or sophisticated adversaries but appears to be instigated by petty cybercriminals trying to profit from coin mining using hijacked computing resources,” Microsoft researchers said.