China-nexus actors abuse live chat platform to spread malware

Updated on: 03 October 2022

Jurgita Lapienytė
Chief Editor

Threat actors abused a free Comm100 Live Chat application to deliver payloads to organizations in the US and Europe.

The CrowdStrike Falcon platform identified a supply chain attack during the installation of Comm100 Live Chat. The platform enables organizations to communicate with their website visitors in real-time.

CrowdStrike researchers said criminals were delivering malware via a signed Comm100 installer that could be downloaded from the company’s website.

“This attack occurred from at least September 27, 2022, through the morning of September 29, 2022. The trojanized file was identified at organizations in the industrial, healthcare, technology, manufacturing, insurance, and telecommunications sectors in North America and Europe,” CrowdStrike said.

Based on Chinese comments in the malware, tactics, techniques, and procedures, it assesses that the actor responsible for this attack likely has a China nexus. The same threat actor has been observed targeting online gambling entities in Asia - a previously established area of focus for China-nexus actors.

Comm100 has released an updated installer following the responsible disclosure by Crowstrike.