According to Trend Micro researchers, APT27 would wait until a new version of MiMi was pushed by developers; within an hour-and-a-half of the new version being released, the threat actors would modify the installer to infect victims. Most of the attacks went unnoticed by victims due to the legitimate MiMi installers being unsigned. When the legitimate installers are downloaded, users must click through many warnings on their machine, so the compromised installers were not viewed as suspicious. Iron Tiger was seen targeting victims in the Philippines and Taiwan, which is consistent with their established Modus Operandi. Researchers have determined that the threat actors deployed the HyperBro backdoor on five of the targets, and deployed rshell on eight of the targets. While the risks from supply chain compromise remain difficult to control, an active vulnerability management program and a strict allow list of third-party applications will assist with mitigating these attacks. Moreover, a defense in depth security program with a focus on detecting post exploitation malicious behaviors remains the best approach to a threat environment that includes zero-day vulnerabilities and supply chain compromise.

https://www.securityweek.com/chinese-cyberspies-use-supply-chain-attack-deliver-windows-macos-malware

https://www.trendmicro.com/en_us/research/22/h/irontiger-compromises-chat-app-Mimi-targets-windows-mac-linux-users.html