EmEditor served an infected installer for three days

EmEditor, a widely used Windows editor for code, text and csv files with support for very large files, was hit by a supply chain attack. The download link on the vendor's own site served a build infected with an infostealer. According to the vendor the window ran from 19 December at 18:39 to 22 December at 12:50 US Pacific time. Researchers at Qianxin have analysed the malware and described the information it sends on to the attacker's infrastructure.

What this means for your organisation

The file came from the correct site and was downloaded by an employee who did everything right. That is precisely what makes supply chain attacks difficult: the controls rest on trust in the source. If anyone installed or updated EmEditor during that window, treat the machine as compromised and rotate credentials.

Berigo recommends

• Check whether anyone downloaded or updated EmEditor between 19 and 22 December, and handle those machines as an incident.
• Rotate passwords and keys used on affected machines.
• Build an inventory of software installed outside central distribution so you can answer quickly next time.
• Put supplier notification duties for security incidents into your contracts.

Source

• emeditor.com
• ti.qianxin.com