A previously unknown advanced persistent threat (APT) group named Carderbee has been linked to a software supply-chain attack that’s currently targeting organizations in several regions in Asia, primarily Hong Kong organizations. Researchers have observed the attacks leveraging a trojanized version of the legitimate software Cobra DocGuard Client, which is produced by the China-based company EsafeNet and used to “protect, encrypt, and decrypt software.” During the observed attacks, malicious activity was identified in one hundred (100) of the victim organizations’ environments while 2,000 organizations had the malicious Cobra DocGuard software installed, which indicated to researchers that the operator was selectively moving further in the attack chain with specific victims. In one case, researchers identified that a downloader was deployed with a digitally signed certificate from Microsoft, which was then used to install the “PlugX” (otherwise known as “Korplug”) backdoor, which is known to be widely used among Chinese state-sponsored threat groups. The attack’s PlugX sample had the capability to execute commands through the command prompt, review running processes, enumerate files, download files, open firewall ports, and act as a keylogger. At the time of publication, researchers stated that “it was not possible to link this activity definitely to a known group, which is why [they] attributed it to a new group.” Carderbee is described as a patient and skilled actor that leverages a supply-chain attack and signed malware to stay under the radar. The origins and goals of Carderbee are currently undocumented. Current technical details of Carderbee’s supply-chain attack as well as indicators of compromise (IOCs) can be viewed in the report linked below.