Microsoft Signed Certificates Used in Malicious Activities
Share this:
Threat actors have been seen exploiting legitimately signed Microsoft drivers in active intrusions into telecommunication, business process outsourcing, managed security service providers, and financial sectors
Initial and detailed findings were first shared with Microsoft in October 2022. Now an advisory has been released detailing the mode of attack
Sentinel Labs discovered Poortry and Stonestop malware while doing an investigation on the misuse, A part of a small toolkit designed to terminate antivirus and endpoint detection and response processes. Successively, the driver was used with a separate userland executable to attempt to control, pause, and kill various processes on the target endpoints.
Advertisements
There is also an observation of a separate threat actor utilizing a similar Microsoft-signed driver, which led to the deployment of Hive ransomware against an entity in the medical industry.
Mandiant discovered that the malicious drivers used as part of these attacks were signed directly by Microsoft. Identifying the original software vendor then required inspecting the signature with code. Several distinct malware families, associated with separate threat actors, have been signed with this process. The security firm identified roughly nine unique organization names associated with attestation-signed malware.
Sophos meanwhile, wrote in its report that the use of device drivers to sabotage or terminate security tools has been increasing in 2022. Previous attacks have employed a ‘bring your own vulnerable driver’ (BYOVD) approach, in which the attackers leverage a Windows driver from a legitimate software publisher with security vulnerabilities.”
Microsoft claimed it has now completed its investigation and determined that the activity was limited to the abuse of specific developer program accounts. It further explained that no compromise had been reportedly identified.
Advertisements
Indicators Of Compromise
- 9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c
- 8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104
- c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497
- 0080fde587d6aedccb08db1317360d32
- 00a7538086c266e8bcf8a0b1c2b6a2e4
- 00dd476fa04da76fc2ed37cfdde59875
- 024e92733def0b1180f0ee54b81e5836
- 03710450e5bebd207bbe471c4685dc49
- 07bac50f875f09ad644827c8918e6837
- 07c4309678ce891fdd868e10c6e7aad4
- 0ae78b90151ec2b0457bb0c2675048f5
- 0b4a0fe7db8400ef65ce7618177351cf
- 0d0ffa28823276732a9e4dea5c25cc34
- 14a1d3e07520df607635a3356877f5b9
- 14e6507566a404e3158b3e36314bb3a1
- 1548b70d8581cbde703b1fb50b48a6a8
- 163118c947aacd0978ad3e019c7d121f
- 179ca82f2e523be47df0dcebe808408d
- 198877a8ce99289f7281b1475c13ba9f
- 19d14bf80b3dc4e5b774b362f079a102
- 19d99758b1f33b418cb008530b61a1e7
- 1e63ec5b89edb805956f347b5b5cfaae
- 1f2888e57fdd6aee466962c25ba7d62d
- 1f46065ac9479253e4babc42b72bc4a8
- 1f929fd617471c4977b522c71b4c91ed
- 207cfc647647419adcfcc44c6059a1d1
- 20f94c9cfc3cf012bf90546985f9f3c4
- 22519936cd9e8c7d524b0590826c3e6e
- 228f9f0a0466fba21ac085626020a8e1
- 22949977ce5cd96ba674b403a9c81285
- 232b0156173a9f8f5db6b65aa91e923b
- 23cebc6b0eb76262d796577895f418d2
- 24eb9eef69475e4980a555898b25f0c1
- 262c92f2437c80adf232ef147ca2d734
- 267c30e484322ad31fa9e1374d6653f0
- 26caf3361ec353593f51ebbd3fe5bbde
- 26d6833b1875b138ea34d6ab430cafcd
- 2739311a6bb1a7b0b88ff24bf603a54d
- 27bb03f2659cd95bf9e7af899ee32728
- 286b10451fe364310f4a7baeb0e94a3f
- 2a12b959c55f4a2d34f96e45e2417a71
- 2aa8dc7a5dff7817ce0a9c7cf30847bf
- 2bec13be352db14fc9665ddf128deb8c
- 2cc14f20cf6847a2084f2c9cc0622015
- 2d84c734d813af49cec3c3aa4aa4e6e3
- 2e323c67a8781531a294684f7d2761ec
- 2f6daca66d2f64c7b1b6f8693ea09cb7
- 309f16f50e9074ce797eb38eda279298
- 331113d1d54a3610f9c9bd72fc783721
- 33b5485b35b33fd8ead5a38899522cce
- 3452586b669e12c1c4ee9db3c1006018
- 35c95b6b5f4a6a0bda56276846dae17b
- 35deaa9d004714dc6ef9661b91889148
- 3608b3a24736dea4bf24a8ac5ae00e30
- 37d4ba16136986bfded2b6fc698abf02
- 395ea8b7d0f257850a3a04a1484bac4d
- 398384a6cf2b7e26947d2e0acbfeeda5
- 39ee31f03fe1bb93d47f560f73deffa9
- 3d4b685dcaebc5bba5f9421572a4ab91
- 3db8146544ee26866a8e99bacb11188c
- 3ecaf3ba4e93916714cc43320f6f2c58
- 3fd815ebb7d2ab2b62cff3c777b51e30
- 4070a8b16f318d108be0984e628421ad
- 40fda9a3c1be41be414f3795b25647f5
- 415240633837ebcbd80e080ba99c03a9
- 42200c8422347f63b3edb45ea5aa9c45
- 42a417e54639c69f033f72bbafe6e09a
- 4349378822e2316f18784c10c7ca08a1
- 45991757d4ca2dab9e81f2fcbbc1ae23
- 45be5c0e7dfe37f88f1fa6c2fbb462c5
- 467e60b9a0d1153057e0cfd0e721e198
- 48190fd615dcea5c6679b8e30a8bfec0
- 486b1afce3484a784a1662513ca1272a
- 48bf11dd6c22e241b745d3bb1d562ca1
- 48fc05c42549d0b3ec9e73bbb5be40dc
- 4a0f22286134a58d9d20f911a608f636
- 4b2e59a821589ab091a63770f4a658ed
- 4d4c17d8b52cd89da0b17cc9653b2010
- 4d947e4163e8aeafbfc626eb033bc665
- 4e1f656001af3677856f664e96282a6f
- 4e8d5c44bfdeffd0168f8a05f6a04e8b
- 4f5c7367f2ebae0097b6f2f1bebd19b6
- 508d42f26f8bd562728e6fca866e05eb
- 50d13758b811c794bc13769ee3b42e85
- 52494f624378ef6ee298f0fc73082d0e
- 52fc9ec7a5c177fe27fb00b6c2c5ff09
- 548d48b658305ffb77cc814ea080b542
- 561bc6902367d9e43e27c5543e7a5818
- 5800a88d39fdf63e5a43bfcc6700d907
- 5b281df4aaa915f660e075dc944a02c2
- 5e5d9971c90287a6aa905e54b2a21b1c
- b00c95692923b8c1e2d45c4a64a5ff05
- b0fea98c70e510f88b57f45a3f516326
- b164daf106566f444dfb280d743bc2f7
- b34403502499741762912c7bfc9ff21f
- b44dfd8c5e7b0c8652d7a647dfe252e4
- b500ee8d8cb045936d2996a1747bcded
- b5c73db8e70d6f46ad9b693f3ce060d2
- b7239e06bcbe6e2c7bb2f7a859cbf4f7
- b83d8761748abb032ab5ae75519eaf71
- b849deae20052d72c3c623660fa97e64
- b8783155d6be5bb3a6d75edaa7ae7f71
- b9d40581ae936662c37f2edc979d7e99
- ba9907be3a0752369082199ed126f8d8
- bb46eb379caae3b05e32d3089c0dd6d0
- bd25be845c151370ff177509d95d5add
- bf13a2f4e2deb62b7dee98a012e94d61
- c0471f78648643950217620f6e7e24cc
- c0debd2cfb62fc2c56bfd4104b1ff760
- c12d465743b9c167fc819b7872cd014c
- c35e6a0e1aef31ed9855499df4317acd
- c5120095bf08655407c2f0215d10ac1d
- c77e931a6388b2040cc7c5a1a0f56d93
- c7850060cfe574a2ef278ba46a136a5e
- c812fa7c628c3e19a3da5910acf6206e
- c8495649615bf1b9f839d7f357d6d02f
- cadc3e4090aed708526f0d6016aba7fd
- cb68b7979bbb55bbde0a8c60fe3e5184
- cb6a416204b57470fab0b944d7b59756
- cbc3d1c88a5d0491b7b50bb77ada93fe
- cc29cf2294175315acbf33054151f3cd
- cd4b6d8bb762c2281c9b1142588ede4c
- ce455358bf71c88b45fcb5789100969a
- ce4d3a69331ff87920c903a4e4091904
- ce658935ef6e223893121dce22908655
- ce6ef4dc1dd54baddaa51eaf594a496a
- d11b9a4664ea03dfe3e8e1d737cd15f8
- d22a56e31b4e1fd5b06d46fa56f59151
- d27fac80339ad1f2ee86374884996c52
- d2ed678542a5d1db494dc47359861467
- d47494b717c82eca8278dea610e1265d
- d60d8f3f12550dca4ba07ff61263b67f
- d60e235b769cadbc7e83090b79b73ed3
- d617c9a86328921a8caf924575faf2a2
- d66fc4e2f537566bb4d91cdea0ac64e5
- d6b2947d8ff985fa84d697cc6cfdb7ff
- d6e506a1e0417c4507a5314529d84e34
- d77209a21352486435d85e339596eeae
- d87f08d1e50f2a3423813bf161b40859
- dc170d9bba14b0421c2514465055a93f
- dc564bac7258e16627b9de0ce39fae25
- dd1a5bd34f8cfa56e439c6fb275356d6
- ddee86b84dcb72835b57b1d049e9e0cd
- de4b5043c82ab3b36b4ae73a2e96d969
- e051141b1dcb9e7f889fea7c8b1d6ba5
- e0e0c46ba4f969919e2879717c60ef2a
- e2465ea5c2d5dac4ae1b8d50da1d7cce
- e2c146a2522e4f40e5036c3fe12c3560
- e30830c05ed3d2a3178a3678f3169bec
- e5f62ef06b0dd656e1e47913f01f9f8a
- e6960ae657786979493da1786191bcf4
- e777e5a8d2ba97c82128f04272e7841c
- e7ff38a94ad765eb305fc7f0837f5913
- ea033ee6df904d863448ffef6386b6ae
- ea45419d992c15002c93067840568121
- ea5f6ab5666193f805d13a49009f0699
- ee3bad1f5508e2129e0b423b009383e3
- ee6b1a79cb6641aa44c762ee90786fe0
- f07506c30237c96e49eecafa0e5a4ed4
- f111bd9b8e55f60f909649820e116430
- f35a8a8f36c13769b9e9fff05fa4f720
- f4ee6bee04b2ed18024e3a64a0d58385
- f59a1409ce773658e72ad73424841890
- f783277840bbd2023879a87d0788f36e
- f78915cbf89d8749a0a4ab18a2b182bd
- f8ccabcbe08bbd2c8420f4d1cffcefd8
- f9844524fb0009e5b784c21c7bad4220
- f9aad310a5d5c80bbc61d10cc797e4f0
- fa00cc96c5bea2979a59d0da0d22c83d
- fa914061f5a40b324454d3fb9fc85ca5
- faa5806826ff1ba749b70de0e14835c3
- fbd9ba2b8b2d677d41c30a01c02cfd01
- fd3b7234419fafc9bdd533f48896ed73
- fd4cee1c7b8167f25a8b4b864ede3c5d
- fdb6dae1e8c182089fdb86996436330c
- fe2f8e46ae540d7299c61ba083d52399
- fe7ecd399eec7036a63f0b7eb5ebcfb1
- ff43f91f2465504e5e67d0b37d92ef18
- ff985a86bfa60576a8e86b05603ac5fa
- 62f289f3b55b0886c419a5077d11eb3c
- 63960dbc7d63767edb6e1e2dc6f0707b
- 63d877650a3219f5991fd66bafc46bc5
- 64a81238d20dcbd4b21abb609040f698
- 66c145233576766013688088b03103e3
- 66d2860a078fb11832ceef28b23481c2
- 67ff9de8e72c4dfdf4b4404abf253e7e
- 688c138fffbb4e7297289433c79d62f5
- 688ca3c12b63fec9f921334d24cf6f78
- 6916b29893f618ba76b36bd8c297b7ac
- 6a066d2be83cf83f343d0550b0b8f206
- 6a23d752fbc30e603bbb050a83a580eb
- 6a893aab7b79b73da7a049c2707aabf1
- 6b0a733568d80be653fc9a568cdd88c5
- 6c3180163e4a5371647e734c7c817de5
- 6c7479b5bb27f250fa32331b6457883a
- 6d32d2d7a44584c92115ac2a2c3ba3af
- 6e1bb443369973923c8eced16fcbd5cf
- 6e3516775e7e009777dcdb7a314f1482
- 6e730cf4ebcd166d26414378cab3a6d8
- 6fcf56f6ca3210ec397e55f727353c4a
- 7182ed3da406ba19bb9ffd8e4948d858
- 721b40a0c2a0257443f7dcc2c697e28a
- 72dbbd1dd61c6b0c2571e83f2c3d1825
- 734b3a6e6cbd1f53fbb693140d2c3049
- 761939b0e442821985ab3281f97e6ceb
- 76c6ae0157ea7f41f55ed7e7d241f910
- 7737e5e40a439899f326279b7face22c
- 77392be5eae901ae371c37861aa88589
- 787782e0395b3d5e32cda6fdea2faba0
- 79ebae9ab3f3b59c754ab1cc82bf7e95
- 7a5896673b81beb5589b512c6d781a85
- 7a9df5c46c7c65b807f78c6c0bb2c38c
- 7b6e3fe75c5ae68d7d5a3ae7b00097e0
- 7ba744b584e28190eb03b9ecd1bb9374
- 7c6c1b7e6378b4c0bcceee84e0e26fde
- 7cb012393114dfb35d60e70166a97986
- 7d78b5773845c5189ca09227d27a9d5a
- 7dd800f100a049a72983dd75f5286d70
- 7e0a6a234a64350e684544e272c7fc41
- 7e2e29707e7a601e8ea7f3e2f4d672a2
- 7e7002dc10c62fb674a3184f4ad6688a
- 7ee0b286003dc9e8006c22dcd70663f0
- 7f9309f5e4defec132b622fadbcad511
- 811f8d76ff00c9eda27b51a0fb2b0d39
- 822bbdec4e5630c3170ee05119dcfb5c
- 8264b3bdf46c0ece4f66151a613baed5
- 832fe73a91993b387f9a49fafb9d4ea7
- 84ce2a917e3d4aefcfc7d17e4a840a99
- 85063d67203b91bef9772446a1723021
- 860f5812d65dc157a59c14e57bc0eaaf
- 8986b5b6013cfb2bd3e6c8d22c453390
- 8ac6ef2475ec89d3709fc124573cb380
- 8af6a129902a594ddaceafba38b7c060
- 8b423e0395ba6419fcedc0701327c97c
- 8d38a092ae5a3511bedadb7243a84409
- 8e4d0f679b092296a2f74cf812907d05
- 8fc8c6e1b2a1047752f60549878fb55f
- 909f3fc221acbe999483c87d9ead024a
- 90affc996a2932cb0fec4e31cd673ae9
- 90b9a4328c4f712815760f9da49bcb6a
- 913d50851abf337abc3c73f2d4e7fb34
- 929b293090bcc7900c1e8f9ba519e219
- 934d0cda4cba428e9b75ff16d5f4b0b1
- 93c5faf90bc889963f10c608cbde5a14
- 947ebc3f481a7b9ee3cf3a34d9830159
- 95a04866e6afb8e9b0426f5890681f9a
- 9885d56d64ac2391a43f02abb2202181
- 9a8323bc7187441a0d85b9a2e8f580e3
- 9c4034691f6508e2361b6fca890671f9
- 9d1424c87d89095e3cd6785adb54d2ec
- 9dabf30a780794200cd068b145730317
- 9e91e55c89f9c17c0a2acaf4376cd72b
- 9f1d60d3cddea7f7558fad0217759094
- a0fdc4543687a1b341b365d6dd16551c
- a2ee1cc9e80390ca248863004adbde60
- a2f3bce86beef23aede69396dcf7e184
- a55cb8be2887e99b4f662fc1ae08d265
- a7251aad1e81c6194b34dabf6edd6b4a
- a9541530619a3ac2615b92603b705fe6
- aba1be25da0691761f593725e9c067e5
- ac2a1f2ae6b547619bef93dfadb48937
- ac7f0fcb6040eb47ea9855d418c32510
- acac842a46f3501fe407b1db1b247a0b
- adab615712eac2719691d01b69254f29
- add02792cfff7b19b8e526a247acb0ba
- ae2f3e2412925a767e372c9c0ccf7ced
- 9b1b15a3aacb0e786a608726c3abfc94968915cedcbd239ddf903c4a54bfcf0c
- 42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25
- 6839fcae985774427c65fe38e773aa96ec451a412caa5354ad9e2b9b54ffe6c1
- 7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6
- d7c81b0f3c14844f6424e8bdd31a128e773cb96cccef6d05cbff473f0ccb9f9c
- 5f6fec8f7890d032461b127332759c88a1b7360aa10c6bd38482572f59d2ba8b
- 0440ef40c46fdd2b5d86e7feef8577a8591de862cfd7928cdbcc8f47b8fa3ffc
- 274340f7185a0cc047d82ecfb2cce5bd18764ee558b5227894565c2f9fe9f6ab
- 0d10c4b2f56364b475b60bd2933273c8b1ed2176353e59e65f968c61e93b7d99
- c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497
- 8e035beb02a411f8a9e92d4cf184ad34f52bbd0a81a50c222cdd4706e4e45104
