# Rapid Response: ASUS Live Update Attack (Operation ShadowHammer)

Attackers compromised ASUS Live Update servers and pushed backdoored Setup.exe updates to ~1M hosts, implanting second-stage malware on ~600 targeted MAC addresses.

- Payout: Real-world hack
- Severity: critical
- Program: ASUS Live
- Analysis by: Huntress
- Disclosed: 2019-03-26
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/faq-asus-liveupdate-attack-operation-shadowhammer-9fc9c03b2da9
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-faq-asus-liveupdate-attack-operation-shadowhammer-9fc9c03b2da9
- Tags: area:os domain:desktop impact:integrity impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:reverse-engineering vuln:misconfiguration vuln:rce

**Target:** Windows Live Update client / update distribution infrastructure
**Root cause:** ASUS's automatic update infrastructure was compromised, allowing attackers to sign and distribute backdoored Live Update packages containing a modified Setup.exe with obfuscated shellcode.
**Steps:**
1. Compromise ASUS Live Update distribution servers (liveupdate01.asus.com / liveupdate01s.asus.com).
2. Replace Live Update packages with backdoored ZIPs (e.g. `Liveupdate_Test_VER365.zip`) containing a modified `Setup.exe` and two MSI files.
3. Modified Setup.exe decrypts and runs obfuscated shellcode that checks host MAC addresses against a target list.
4. If MAC matches, download and implant second-stage payload; otherwise write `idx.ini` up to two directories above Setup.exe execution path as an artifact.
**How found:** Kaspersky and Kim Zetter's reporting plus reverse engineering of the backdoored Setup.exe revealed the shellcode and idx.ini artifact; Huntress built detection tooling around Live Update version and idx.ini presence.
**Exploitation:** Backdoored updates were served to over a million ASUS hosts via Live Update; the shellcode fingerprinted MAC addresses and only ~600 targeted machines received the second-stage implant, keeping the campaign stealthy.
**Escalation:** Selective targeting by MAC address minimized exposure and detection while still reaching a massive distribution base.
**Insight:** Supply-chain update clients that lack signature verification of the update payload let server compromise translate directly into code execution on every endpoint; check for leftover artifacts like idx.ini written by shellcode during fingerprinting.

## Proof of concept (copied exactly from the original report)

**Malicious Live Update ZIP URLs**

```
hxxp://liveupdate01.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER365.zip
 
- hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER362.zip
 
- hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER360.zip
 
- hxxps://liveupdate01s.asus[.]com/pub/ASUS/nb/Apps_for_Win8/LiveUpdate/Liveupdate_Test_VER359.zip
```