Subvert Trust Controls: Code Signing

Anchor has been signed with valid certificates to evade detection by security tools.^[5]

AppleJeus has used a valid digital signature from Sectigo to appear legitimate.^[6]

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.^[7][8]

APT41 DUST used stolen code signing certificates for DUSTTRAP malware and subsequent payloads.^[9]

BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.^[10]

Bandook was signed with valid Certum certificates.^[11]

Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD.^[12]

The Black Basta dropper has been digitally signed with a certificate issued by Akeo Consulting for legitimate executables used for creating bootable USB drives.^[13]

BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.^[14]

BOOSTWRITE has been signed by a valid CA.^[15]

For C0015, the threat actors used DLL files that had invalid certificates.^[16]

ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.^[17][18][19]

CHIMNEYSWEEP has been dropped by a self-extracting archive signed with a valid digital certificate.^[20]

Clop can use code signing to evade detection.^[21]

Cobalt Strike can use self signed Java applets to execute signed applet attacks.^[22][23]

CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.^[24]

CSPY Downloader has come signed with revoked certificates.^[25]

Daggerfly has used signed, but not notarized, malicious files for execution in macOS environments.^[26]

Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.^[27][28]

Some Daserf samples were signed with a stolen digital certificate.^[29]

Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.^[30]

Ecipekac has used a valid, legitimate digital signature to evade detection.^[31]

Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.^[32]

FIN6 has used Comodo code-signing certificates.^[33]

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.^[34][35]

GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.^[36]

Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."^[37][38]

GreyEnergy digitally signs the malware with a code-signing certificate.^[39]

Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.^[40]

The HermeticWiper executable has been signed with a legitimate certificate issued to Hermetica Digital Ltd.^{[41][42][43][44]}

HermeticWizard has been signed by valid certificates assigned to Hermetica Digital.^[45]

Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.^[46]

Kimsuky has signed files with the name EGIS CO,. Ltd..^[47]

Lazarus Group has digitally signed malware and utilities to evade detection.^[48]

Leviathan has used stolen code signing certificates to sign malware.^[49][50]

LockerGoga has been signed with stolen certificates in order to make it look more legitimate.^[51]

LuminousMoth has signed their malware with a valid digital signature.^[52]

MacMa has been delivered using ad hoc Apple Developer code signing certificates.^[53]

menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.^[31]

Metamorfo has digitally signed executables using AVAST Software certificates.^[54]

Molerats has used forged Microsoft code-signing certificates on malware.^[55]

More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.^[33]

Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.^[56]

Nerex drops a signed Microsoft DLL to disk.^[57]

During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.^[58]

During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature.^[59]

Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.^[10]

PipeMon, its installer, and tools are signed with stolen code-signing certificates.^[60]

PROMETHIUM has signed code with self-signed certificates.^[61]

QakBot can use signed loaders to evade detection.^[62][63]

A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.^[64]

ROADSWEEP has been digitally signed with a certificate issued to the Kuwait Telecommunications Company KSC.^[65]

RTM samples have been signed with a code-signing certificates.^[66]

Saint Bear has used an initial loader malware featuring a legitimate code signing certificate associated with "Electrum Technologies GmbH."^[67]

Scattered Spider has used self-signed and stolen certificates originally issued to NVIDIA and Global Software LLC.^[68]

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).^[69]

During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.^[70]

SpicyOmelette has been signed with valid digital certificates.^[71]

StrongPity has been signed with self-signed certificates.^[61]

Stuxnet used a digitally signed driver with a compromised Realtek certificate.^[72]

Suckfly has used stolen certificates to sign its malware.^[73]

SUNBURST was digitally signed by SolarWinds from March - May 2020.^[70]

SysUpdate has been signed with stolen digital certificates.^[74]

TA505 has signed payloads with code signing certificates from Thawte and Sectigo.^[75][76][77]

TrickBot has come with a signed downloader component.^[5]

Winnti Group used stolen certificates to sign its malware.^[78]

Wizard Spider has used Digicert code-signing certificates for some of its malware.^[79]

ZeroCleare can deploy a vulnerable, signed driver on a compromised host to bypass operating system safeguards.^[80]