Stephen Fewer
The @rapid7 MDR team uncovered a backdoored installer for the Justice AV Solutions (JAVS) Viewer application, that was being served out via the official JAVS website. CISA has assigned this CVE-2024-4978. Full details, timelines, guidance, and IOCs here: https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/