Procedure examples

QakBot can use signed loaders to evade detection.

Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.

HermeticWizard has been signed by valid certificates assigned to Hermetica Digital.

CSPY Downloader has come signed with revoked certificates.

A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.

TeamPCP has compromised legitimate software release workflows resulting in malicious packages receiving legitimate project cryptographic signing.

ZeroCleare can deploy a vulnerable, signed driver on a compromised host to bypass operating system safeguards.

RTM can add a certificate to the Windows store.

Hikit installs a self-generated certificate to the local trust store as a root CA and Trusted Publisher.

Dok installs a root certificate to aid in Adversary-in-the-Middle actions using the command add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/filename.

certutil can be used to install browser root certificates as a precursor to performing Adversary-in-the-Middle between connections to banking websites. Example command: certutil -addstore -f -user ROOT ProgramData\cert512121.der.

evilginx2 has obtained a valid SSL/TLS certificate from LetsEncrypt to provide responses to Automatic Certificate Management Environment (ACME) challenges.

APT38 has used ISO and VHD files to deploy malware and to bypass Mark-of-the-Web (MOTW) security measures.

TA505 has used .iso files to deploy malicious .lnk files.

APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.

Amadey has modified the `:Zone.Identifier` in the ADS area to zero.

QakBot has been packaged in ISO files in order to bypass Mark of the Web (MOTW) security measures.

APT39 has used malware to turn off the RequireSigned feature which ensures only signed DLLs can be run on Windows.

Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.

BlackEnergy has enabled the TESTSIGNING boot configuration option to facilitate loading of a driver component.

Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component.

Pandora can use CVE-2017-15303 to disable Windows Driver Signature Enforcement (DSE) protection and load its driver.

During RedPenguin, UNC3886 peformed a local memory patching attack to modify the snmpd and mgd Junos OS daemons.

During Cutting Edge, threat actors trojanized legitimate files in Ivanti Connect Secure appliances with malicious code.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.

UNC3886 has trojanized Fortinet firmware and replaced the legitimate `/usr/bin/tac_plus` TACACS+ daemon for Linux with a malicious version containing credential logging functionality.

APT5 has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.

LITTLELAMB.WOOLTEA can append malicious components to the `tmp/tmpmnt/bin/samba_upgrade.tar` archive inside the factory reset partition in attempt to persist post reset.

BUSHWALK can embed into the legitimate `querymanifest.cgi` file on compromised Ivanti Connect Secure VPNs.

BOLDMOVE contains a watchdog-like feature that monitors a particular file for modification. If modification is detected, the legitimate file is backed up and replaced with a trojanized file to allow for persistence through likely system upgrades.

Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.

LIGHTWIRE can imbed itself into the legitimate `compcheckresult.cgi` component of Ivanti Connect Secure VPNs to enable command execution.

ThiefQuest searches through the /Users/ folder looking for executable files. For each executable, ThiefQuest prepends a copy of itself to the beginning of the file. When the file is executed, the ThiefQuest code is executed first. ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior.

GlassWorm can modify hardware wallet applications.

Kobalos replaced the SSH client with a trojanized SSH client to steal credentials on compromised systems.

WARPWIRE can embed itself into a legitimate file on compromised Ivanti Connect Secure VPNs.

FRAMESTING can embed itself in the CAV Python package of an Ivanti Connect Secure VPN located in `/home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/resources/category.py.`

WIREFIRE can modify the `visits.py` component of Ivanti Connect Secure VPNs for file download and arbitrary command execution.

Kessel has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.

PHASEJAM has modified legitimate components to enable persistence and execution, including inserting a web shell into `getComponent.cgi` and `restAuth.cgi`, modifying `DSUpgrade.pm` to block system upgrades, and overwriting `remotedebug` to execute arbitrary commands when specific parameters are provided.

BFG Agonizer uses DLL unhooking to remove user mode inline hooks that security solutions often implement. BFG Agonizer also uses IAT unhooking to remove user-mode IAT hooks that security solutions also use.

Ebury modifies the `keyutils` library to add malicious behavior to the OpenSSH client and the curl library.

XCSSET uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules.

Industroyer has used a Trojanized version of the Windows Notepad application for an additional backdoor persistence mechanism.

SLOWPULSE is applied in compromised environments through modifications to legitimate Pulse Secure files.

Mini Shai-Hulud has established persistence through modifying software binaries to include AI coding agents’ configuration or setting files that act as hooks, tasks or execution triggers.

During the SolarWinds Compromise, APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.

During the 2025 Poland Wiper Attacks, the adversaries configured a native CLI to gather a targeted elevated users password using `grep`.

Volt Typhoon has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.

APT41 has obtained information about accounts, lists of employees, and plaintext and hashed passwords from databases.