Procedure examples

Mini Shai-Hulud has gathered credentials and secrets from AWS, Google Cloud Platform (GCP) and Azure metadata API.

Wizard Spider has used PowerShell cmdlets `Get-GPPPassword` and `Find-GPOPassword` to find unsecured credentials in a compromised network group policy.

APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.

MirrorStealer can target Group Policy Preferences for credentials.

SILENTTRINITY has a module that can extract cached GPP passwords.

PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.

Peirates can query the Kubernetes API for secrets.

TeamPCP Cloud Stealer can query the Kubernetes API for credentials.

Mini Shai-Hulud has gathered unsecured API keys stored in container orchestrators.

LAPSUS$ has targeted various collaboration tools like Slack, Teams, JIRA, Confluence, and others to hunt for exposed credentials to support privilege escalation and lateral movement.

Axiom has used digital certificates to deliver malware.

Shai-Hulud has suppressed victim NPM warnings using `process[“exit’](0x0);` which results in having all errors exit with code 0.

Cuckoo Stealer can use `xattr -d com.apple.quarantine` to remove the quarantine flag attribute.

OSX_OCEANLOTUS.D uses the command xattr -d com.apple.quarantine to remove the quarantine file attribute used by Gatekeeper.

MacMa has removed the `com.apple.quarantineattribute` from the dropped file, `$TMPDIR/airportpaird`.

CoinTicker downloads the EggShell mach-o binary using curl, which does not set the quarantine flag.

XCSSET has dropped a malicious applet into an app's `.../Contents/MacOS/` folder of a previously launched app to bypass Gatekeeper's security checks on first launch apps (prior to macOS 13).

If running with elevated privileges, OSX/Shlayer has used the spctl command to disable Gatekeeper protection for a downloaded file. OSX/Shlayer can also leverage system links pointing to bash scripts in the downloaded DMG file to bypass Gatekeeper, a flaw patched in macOS 11.3 and later versions. OSX/Shlayer has been Notarized by Apple, resulting in successful passing of additional Gatekeeper checks.

During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.

Mustang Panda used legitimate, signed binaries such as `inkform.exe` or `ExcelRepairToolboxLauncher.exe` for follow-on execution of malicious DLLs through DLL search order hijacking in RedDelta Modified PlugX Infection Chain Operations.

During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature.

Although the X_TRADER platform was reportedly discontinued in 2020, it was still available for download from the legitimate Trading Technologies website in 2022. During the 3CX Supply Chain Attack, AppleJeus used a code signing certificate to digitally sign the malicious software with an expiration date set to October 2022. This file was signed with the subject “Trading Technologies International, Inc” and contained the executable file Setup.exe, also signed with the same digital certificate.

For C0015, the threat actors used DLL files that had invalid certificates.

During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.

During Operation AkaiRyū, MirrorFace abused a signed McAfee executable to load UPPERCUT.

APT41 DUST used stolen code signing certificates for DUSTTRAP malware and subsequent payloads.

GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.

Kimsuky has signed files with the name EGIS CO,. Ltd. and has stolen a valid certificate that is used to sign the malware and the dropper.

Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.

menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.

FIN6 has used Comodo code-signing certificates.

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.

Mustang Panda has used valid legitimate digital signatures and certificates to evade detection.

Scattered Spider has used self-signed and stolen certificates originally issued to NVIDIA and Global Software LLC.

Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.

OilRig has signed its malware with stolen certificates.

Suckfly has used stolen certificates to sign its malware.

Saint Bear has used an initial loader malware featuring a legitimate code signing certificate associated with "Electrum Technologies GmbH."

Leviathan has used stolen code signing certificates to sign malware.

TA505 has signed payloads with code signing certificates from Thawte and Sectigo.

MirrorFace has abused a known Microsoft digital signature verification issues to append encrypted data to digital signatures that still appear to be validly signed.

Medusa Group has utilized vulnerable or signed drivers to kill or delete services associated with endpoint detection and response (EDR) tools.

Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.

LuminousMoth has signed their malware with a valid digital signature.

Winnti Group used stolen certificates to sign its malware.

Lazarus Group has digitally signed malware and utilities to evade detection.

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).

CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.

Wizard Spider has used Digicert code-signing certificates for some of its malware.