Subvert Trust Controls: Code Signing

Anchor has been signed with valid certificates to evade detection by security tools.^[4]

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.^[5]

BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.^[6]

BOOSTWRITE has been signed by a valid CA.^[7]

ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.^[8][9][10]

CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.^[11]

Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.^[12][13]

Some Daserf samples were signed with a stolen digital certificate.^[14]

Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.^[15]

Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.^[16]

FIN6 has used Comodo code-signing certificates.^[17]

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.^[18][19]

Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."^[20][21]

GreyEnergy digitally signs the malware with a code-signing certificate.^[22]

Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.^[23]

Honeybee uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems.^[24]

Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.^[25]

Leviathan has used stolen code signing certificates to sign malware.^[26][27]

LockerGoga has been signed with stolen certificates in order to make it look more legitimate.^[28]

Metamorfo has digitally signed executables using AVAST Software certificates.^[29]

Molerats has used forged Microsoft code-signing certificates on malware.^[30]

More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.^[17]

Nerex drops a signed Microsoft DLL to disk.^[31]

Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.^[6]

PipeMon, its installer, and tools are signed with stolen code-signing certificates.^[32]

PROMETHIUM has signed code with self-signed certificates.^[33]

A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.^[34]

RTM samples have been signed with a code-signing certificates.^[35]

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).^[36]

StrongPity has been signed with self-signed certificates.^[33]

Suckfly has used stolen certificates to sign its malware.^[37]

Sunburst was digitally signed by SolarWinds from March - May 2020.^[38]

TA505 has signed payloads with code signing certificates from Thawte and Sectigo.^[39][40][41]

TrickBot has come with a signed downloader component.^[4]

UNC2452 was able to get Sunburst signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.^[38]

Winnti Group used stolen certificates to sign its malware.^[42]

Wizard Spider has used Digicert code-signing certificates for some of its malware.^[43]