Carderbee Stings Hong Kong: The Wolves Hid In The Grain Delivery Truck
Oh good. Another Tuesday.
So apparently there's a fresh pack of wolves calling themselves "Carderbee" and they've figured out something the security community has been screaming about for years: if you can't trick the lambs directly, just poison the thing they trust. Specifically, legitimate software update packages. The kind your flock clicks "install" on without reading a single word because it has a progress bar and progress bars feel safe.
The targets are organizations in Hong Kong and broader Asia. Real companies. Real networks. Real lambs, blissfully chewing their cud while a trojanized update quietly unpacked itself on their workstations.
The attack vector here is the supply chain. Carderbee compromised the update mechanism for Cobra DocGuard, a legitimate software product, and used it to push parasites directly onto endpoints. No fake grain required. The delivery truck itself was the weapon.
That's the part that should keep you up at night. It keeps me up at night. Although honestly at this point I'm not sure I've slept since the last incident report.
Once inside, the wolves dropped a version of PlugX, which is a well-documented remote access parasite that has been kicking around threat actor toolkits for years. It's basically the cockroach of malware. It lets them poke around your pasture, exfiltrate data, and generally make your week significantly worse.
The really insulting part: only a small subset of the compromised machines actually received the full payload. Carderbee was selective. Targeted. They knew which lambs they wanted. That level of patience and precision means this wasn't some opportunistic coyote. Someone did their homework.
The Shepherds, predictably, probably approved the software purchase without a security review. I'm sure there's a ticket about it somewhere that nobody actioned.
Remediation
Look, I'm tired, but here's what you do:
Verify your update sources. Software update mechanisms should be validated with code signing. If the signature doesn't check out, the update doesn't run. Full stop.
Audit your third-party software inventory. Yes, all of it. Yes, including that thing Dave in Finance installed in 2019.
Endpoint detection needs behavioral rules. PlugX has known patterns. If your detection tooling isn't flagging it, your tooling needs shearing.
Segment your network. If a parasite lands on one sheep, it should not be able to waltz through the entire pasture before anyone notices.
Threat hunt for lateral movement. Assume something got in. Go look. Find it before it finds everything else.
Carderbee is patient. Be less oblivious than your lambs. That's the bar. It's a low bar. Clear it.
Going to go stare at SIEM logs and question my career choices now.
Original Report: https://thehackernews.com/2023/08/carderbee-attacks-hong-kong.html