Code Signing

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.

CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.

Daggerfly has used signed, but not notarized, malicious files for execution in macOS environments.

Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.

FIN6 has used Comodo code-signing certificates.

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.

GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.

Kimsuky has signed files with the name EGIS CO,. Ltd. and has stolen a valid certificate that is used to sign the malware and the dropper.

Anchor has been signed with valid certificates to evade detection by security tools.

AppleJeus has used a valid digital signature from Sectigo to appear legitimate.

BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.

Bandook was signed with valid Certum certificates.

Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD.

The Black Basta dropper has been digitally signed with a certificate issued by Akeo Consulting for legitimate executables used for creating bootable USB drives.

BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.

BOOKWORM has used valid legitimate digital signatures and certificates to evade detection.

Although the X_TRADER platform was reportedly discontinued in 2020, it was still available for download from the legitimate Trading Technologies website in 2022. During the 3CX Supply Chain Attack, AppleJeus used a code signing certificate to digitally sign the malicious software with an expiration date set to October 2022. This file was signed with the subject “Trading Technologies International, Inc” and contained the executable file Setup.exe, also signed with the same digital certificate.

APT41 DUST used stolen code signing certificates for DUSTTRAP malware and subsequent payloads.

For C0015, the threat actors used DLL files that had invalid certificates.

During Operation AkaiRyū, MirrorFace abused a signed McAfee executable to load UPPERCUT.

During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.

During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature.

Mustang Panda used legitimate, signed binaries such as `inkform.exe` or `ExcelRepairToolboxLauncher.exe` for follow-on execution of malicious DLLs through DLL search order hijacking in RedDelta Modified PlugX Infection Chain Operations.

During the SolarWinds Compromise, APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.