25,000+ Endpoints Exposed by Dragon Boss Solutions Update Domain Supply Chain Attack

Summary of the Dragon Boss Solutions Update Domain Supply Chain Attack

Overview:

Dragon Boss Solutions, a software update domain provider, was compromised in a supply chain attack that affected over 25,000 endpoints. The attackers used this breach to distribute malware and disable security measures on infected systems.

Key Points:

1. Attack Vector:

   • Dragon Boss Solutions' update domain was hijacked by threat actors.
   • Malicious updates were pushed out to users of software signed with the compromised certificate.

2. Impact:

   • Over 25,000 endpoints were affected across multiple industries and geographies.
   • The attack targeted Windows Defender, Malwarebytes, and Kaspersky update domains, redirecting them to malicious IP addresses (0.0.0.0).

3. Malicious Activities:

   • Modified the hosts file to block AV vendor updates.
   • Added exclusions for Windows Defender paths like DGoogle, EMicrosoft, and DDapps.
   • Disabled Chrome's auto-update feature using a specific flag.

4. Detection Indicators:

   • WMI event subscriptions containing "MbRemoval" or "MbSetup".
   • Scheduled tasks pointing to

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.