Procedure examples

GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.

Kimsuky has signed files with the name EGIS CO,. Ltd. and has stolen a valid certificate that is used to sign the malware and the dropper.

Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.

menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.

FIN6 has used Comodo code-signing certificates.

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.

Mustang Panda has used valid legitimate digital signatures and certificates to evade detection.

Scattered Spider has used self-signed and stolen certificates originally issued to NVIDIA and Global Software LLC.

Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.

OilRig has signed its malware with stolen certificates.

Suckfly has used stolen certificates to sign its malware.

Saint Bear has used an initial loader malware featuring a legitimate code signing certificate associated with "Electrum Technologies GmbH."

Leviathan has used stolen code signing certificates to sign malware.

TA505 has signed payloads with code signing certificates from Thawte and Sectigo.

MirrorFace has abused a known Microsoft digital signature verification issues to append encrypted data to digital signatures that still appear to be validly signed.

Medusa Group has utilized vulnerable or signed drivers to kill or delete services associated with endpoint detection and response (EDR) tools.

Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.

LuminousMoth has signed their malware with a valid digital signature.

Winnti Group used stolen certificates to sign its malware.

Lazarus Group has digitally signed malware and utilities to evade detection.

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).

CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.

Wizard Spider has used Digicert code-signing certificates for some of its malware.

Molerats has used forged Microsoft code-signing certificates on malware.

PROMETHIUM has signed code with self-signed certificates.

Daggerfly has used signed, but not notarized, malicious files for execution in macOS environments.

TeamPCP has compromised legitimate software release workflows resulting in malicious packages receiving legitimate project cryptographic signing.