ShadowHammer
ShadowHammer is the name Kaspersky gave to a supply-chain malware operation that abused ASUS’s Live Update infrastructure to distribute a trojanized, digitally signed software update to Windows systems. The malicious update was signed with legitimate ASUS digital certificates, including two compromised ASUS certificates, and was distributed between June and November 2018 through the ASUS Live Update Utility, which was factory-installed on ASUS laptops and other devices. The trojanized file, reported as setup.exe, was based on a legitimate 2015 ASUS update binary that attackers modified and re-signed.
The campaign reportedly reached a very large victim base: Kaspersky estimated roughly 500,000 Windows machines received the malicious update, found more than 57,000 affected among its own customers, and Symantec said at least 13,000 of its customers received it. Despite this scale, the operation was highly selective. The malware contained hashed MAC addresses used to identify intended victims, with researchers assessing that only about 600 systems were actual targets. If a device matched the embedded target list, the malware contacted the attacker-controlled domain asushotfix.com to retrieve a second-stage backdoor; non-targeted victims generally saw little or no follow-on activity.
The operation has been referred to as Operation ShadowHammer and is explicitly described as a supply-chain attack. Reporting in the provided content links it to activity associated with APT41, and the 2020 U.S. Department of Justice indictment of three Chinese nationals allegedly tied to APT41 cited ShadowHammer alongside CCleaner and ShadowPad supply-chain attacks. Kaspersky also linked ShadowHammer to prior ShadowPad- and CCleaner-related activity. High-confidence indicators and artifacts mentioned in the content include the ASUS Live Update vector, malicious setup.exe delivered as an updater update, use of legitimate ASUS signing certificates, embedded hashed MAC address targeting logic, and C2/domain contact to asushotfix.com for second-stage payload retrieval.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The company plans to release a full technical paper and presentation about the ASUS attack, which it has dubbed ShadowHammer, next month at its Security Analyst Summit in Singapore.
In 2020, the Department of Justice indicted three Chinese nationals believed to be part of APT41 for conducting supply chain attacks [CCleaner, ShadowPad, ShadowHammer], data theft, and breaches against countries worldwide.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family referenced in connection with APT41 supply chain attacks.
Supply-chain malware delivered through the ASUS Live Update Utility using compromised digital signatures and hijacked updates; it selectively conducted follow-on activity against specific targets.
...instrumental in our investigations into the LightSpy, TajMahal, Dtrack, ShadowHammer and ShadowPad campaigns.
A supply-chain backdoor delivered through the compromised ASUS Live Update infrastructure. The trojanized, legitimately signed update checked infected systems against hard-coded hashed MAC addresses and, for selected targets, contacted a command-and-control server to download a second-stage backdoor.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.