Microsoft Threat Intelligence identified a supply chain attack by the North Korean group Diamond Sleet (ZINC) involving a compromised CyberLink application installer. The installer, signed with a valid CyberLink certificate, was modified to include malicious code that downloads a second-stage payload. This attack affected over 100 devices in countries like Japan, Taiwan, Canada, and the U.S. Microsoft has notified CyberLink, alerted affected customers, and taken measures such as adding the compromised certificate to its disallowed list and updating security detections.