Breach Year
2019
Breach Type
Software Supply Chain Attack
TPRM Lesson
A signed update from a hardware vendor is still a supply chain channel.
What was the ASUS ShadowHammer Software Update Attack breach?
ShadowHammer was a 2018 to 2019 supply chain attack, disclosed by Kaspersky in March 2019, in which attackers compromised ASUS's Live Update infrastructure and distributed a digitally signed but trojanised utility to more than one million ASUS notebook users, targeting a narrow list of specific MAC addresses.
ShadowHammer is the case that showed a signed update from a hardware vendor is still a supply chain channel.
Attackers hijacked ASUS's own update mechanism, so every affected user's operating system trusted the malicious binary.
The scale was massive, but the true target was a curated list of hundreds of specific machines.
ASUS Live Update is the OEM utility used to deliver BIOS, driver and firmware updates to ASUS notebook customers.
June to Nov 2018. Attackers compromised ASUS build or delivery infrastructure and injected a backdoor into Live Update.
Late 2018. Kaspersky detected the trojanised binary via telemetry.
March 2019. Kaspersky and ASUS publicly disclosed the attack.
Impact. Over one million ASUS users received the signed but malicious utility.
ShadowHammer drove enterprise policies to strip or block OEM utilities on managed endpoints and pushed hardware vendors to harden their build pipelines.
The attackers only wanted a few hundred machines but had to compromise a million to reach them. The blast radius was the cost of precision.
A. Identity and Access. Restrict admin utility execution.
B. SaaS and API Integrations. Control auto-update endpoints.
C. Software Supply Chain. Require SBOMs and pipeline attestations.
D. File Transfer and Data Exchange. Monitor outbound telemetry from OEM utilities.
E. Data Protection. Segment endpoints from crown-jewel systems.
F. Vendor Incident Response. Require rapid vendor disclosure.
G. Fourth-Party Risk. Assess signing and build providers.
H. Board and Executive Reporting. OEM supply chain quarterly review.
"A trusted signature is a trusted attacker if the pipeline is compromised."
A 2018 to 2019 supply chain attack on ASUS Live Update.
Kaspersky researchers.
Over one million ASUS users received the trojanised update.
A curated list of hundreds of specific machines identified by MAC address.
The compromise was in the vendor's own build and delivery pipeline.
Behavioural monitoring, endpoint segmentation and OEM utility hygiene.
Vendor pipelines are attack paths.
Yes, with pipeline hardening and public disclosure.
All claims in this case study are grounded in verified public reporting.
TPRM Blog
Continue learning with the latest breach alerts, regulatory updates, and analyst playbooks from blog.learntprm.com.
Founding SponsorAlmost every case here was findable before it happened
Read enough third-party breaches and the pattern is brutal: an undisclosed fourth party, an expired certification, an exposure that sat on the internet for weeks. Nobody was lazy - the signals simply arrive faster than a human review cycle. The SAFE TPRM AI Co-Worker watches for them continuously.
This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.
Five correlated data dimensions per vendor, refreshed continuously across the whole portfolio.
For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.
25+
AI agents
90%
Less manual effort
None
Additional headcount
200+
Organizations globally
End to end
Intake to offboarding
Most people talk about risk management. Few can prove their expertise under pressure.
Start Your Free Certification