Subvert Trust Controls: Code Signing

Anchor has been signed with valid certificates to evade detection by security tools.^[4]

AppleJeus has used a valid digital signature from Sectigo to appear legitimate.^[5]

APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.^[6]

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.^[7][8]

BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.^[9]

Bandook was signed with valid Certum certificates.^[10]

Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD.^[11]

BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.^[12]

BOOSTWRITE has been signed by a valid CA.^[13]

ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.^[14][15][16]

Clop can use code signing to evade detection.^[17]

Cobalt Strike can use self signed Java applets to execute signed applet attacks.^[18][19]

CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.^[20]

CSPY Downloader has come signed with revoked certificates.^[21]

Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.^[22][23]

Some Daserf samples were signed with a stolen digital certificate.^[24]

Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.^[25]

Ecipekac has used a valid, legitimate digital signature to evade detection.^[26]

Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.^[27]

FIN6 has used Comodo code-signing certificates.^[28]

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.^[29][30]

GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.^[31]

Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."^[32][33]

GreyEnergy digitally signs the malware with a code-signing certificate.^[34]

Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.^[35]

The HermeticWiper executable has been signed with a legitimate certificate issued to Hermetica Digital Ltd.^{[36][37][38][39]}

HermeticWizard has been signed by valid certificates assigned to Hermetica Digital.^[40]

Honeybee uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems.^[41]

Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.^[42]

Kimsuky has signed files with the name EGIS CO,. Ltd..^[43]

Lazarus Group has digitally signed malware and utilities to evade detection.^[44][45]

Leviathan has used stolen code signing certificates to sign malware.^[46][47]

LockerGoga has been signed with stolen certificates in order to make it look more legitimate.^[48]

menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.^[26]

Metamorfo has digitally signed executables using AVAST Software certificates.^[49]

Molerats has used forged Microsoft code-signing certificates on malware.^[50]

More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.^[28]

Nerex drops a signed Microsoft DLL to disk.^[51]

Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.^[9]

PipeMon, its installer, and tools are signed with stolen code-signing certificates.^[52]

PROMETHIUM has signed code with self-signed certificates.^[53]

QakBot can use signed loaders to evade detection.^[54]

A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.^[55]

RTM samples have been signed with a code-signing certificates.^[56]

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).^[57]

SpicyOmelette has been signed with valid digital certificates.^[58]

StrongPity has been signed with self-signed certificates.^[53]

Stuxnet used a digitally signed driver with a compromised Realtek certificate.^[59]

Suckfly has used stolen certificates to sign its malware.^[60]

SUNBURST was digitally signed by SolarWinds from March - May 2020.^[6]

TA505 has signed payloads with code signing certificates from Thawte and Sectigo.^[61][62][63]

TrickBot has come with a signed downloader component.^[4]

Winnti Group used stolen certificates to sign its malware.^[64]

Wizard Spider has used Digicert code-signing certificates for some of its malware.^[65]