Malicious Code-signing at Scale: How Attackers Impersonate Thousands of Real Businesses

Malicious Code-signing at Scale: How Attackers Impersonate Thousands of Real Businesses

Speakers: Aaron Walton, Senior Threat Intel Analyst, Expel

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=F-dC0rgAqTo

Overview

In the contemporary threat landscape, code signing certificates are a fundamental component of software trust, designed to assure users that an executable originates from a verified publisher and has not been tampered with. However, as highlighted by Aaron Walton, Senior Threat Intel Analyst at Expel, in his FIRSTCON talk, "Malicious Code-signing at Scale," this robust system is increasingly being subverted by threat actors. Walton, also the official representative of the Cert Graveyard—a volunteer database tracking certificate abuse—unveils how attackers are not primarily stealing certificates, but rather engaging in "malicious compliance" to acquire thousands of new, legitimate-looking certificates.

This talk dissects the intricate methods employed by cybercriminals to bypass the stringent validation processes of Certificate Authorities (CAs), including elaborate impersonation schemes, the use of shell companies, and even direct compromise of CA systems. The implications are profound: malicious software, from infostealers to ransomware loaders, can execute with the deceptive veneer of legitimacy, often bypassing initial security warnings and challenging traditional detection mechanisms. Walton’s presentation serves as a critical call to action for defenders, outlining practical strategies for detection, reporting, and prevention in the face of this sophisticated and rapidly evolving threat.

Background

▶ Watch: Code signing basics and Extended Validation certificates (0:00)

At its core, code signing leverages public key infrastructure (PKI) to establish trust in software. Similar to how PKI validates emails or server certificates, code signing certificates are specifically for software, ensuring it originates from a trusted party and has not been altered. The most significant type of certificate discussed is the Extended Validation (EV) certificate. Historically, EV certificates offered an instant bypass for Microsoft SmartScreen, granting attackers easy access to systems and making them a prized asset in cybercrime.

The process for obtaining an EV certificate is described as "grueling." A Certificate Authority (CA) meticulously validates the legitimacy of an organization and the individual applying on its behalf. This involves verifying the organization's existence, the applicant's authority, and often video verification to confirm identity. Upon successful validation, the applicant receives a hardware token containing the private keys, enabling them to sign software. When software is signed, this cryptographic information is appended to the executable (e.g., in the overlay of a Portable Executable or an MSI bundle). This establishes a chain of trust: Microsoft trusts CAs, which in turn vet and issue certificates to software developers. Users can verify this chain by right-clicking a file and examining its security properties, seeing the root CA (e.g., Thawte) and its intermediate certificates leading to the software provider. Beyond establishing trust, code signing also prevents tampering; even a single byte change invalidates the signature, as the system compares a stored hash with a computed hash of the file.

While the system is robust, attackers relentlessly seek avenues for abuse. Contrary to common belief, the theft of existing code signing certificates has become "really rare" due to the widespread adoption of hardware tokens. While high-profile cases of theft have occurred, they cannot meet the sheer demand from malicious actors. Instead, the problem has shifted to the acquisition of new, seemingly legitimate certificates through various deceptive means. This pervasive issue is extensively tracked by the Cert Graveyard, a volunteer-driven database established in 2015, which serves as a historical record of certificate abuse and actively reports malicious certificates to CAs for revocation.

Key Findings

▶ Watch: Black Basta case study: value of EV certs to criminals (8:45)

The scale of code signing certificate abuse is substantial and growing. As of the talk, the Cert Graveyard database contained approximately 2,500 abused certificates, with an alarming rate of about 70 new certificates being issued directly to cybercriminals each month. These figures are conservative, as the Cert Graveyard actively reports and revokes certificates, suggesting the true number of attempted abuses is far higher.

Walton presented a compelling overview of the top malware families leveraging these certificates:

• Qakbot and Solar Marker: Both now inactive, these pioneers used over 100 unique certificates each, setting a high bar for large-scale abuse.
• Net Support RAT: Malicious installations of the legitimate remote management tool.
• John Stealer (renamed Ghost RAT): Another remote access tool.
• Lumma Stealer: A prominent infostealer.
• UNC 50: A unique malware tracked primarily by Expel, distributed via malicious Facebook ads, "not safe to work" applications, and fake AI programs.
• Oyster Loader: An initial access tool frequently associated with the REvil ransomware gang.
• Screen Connect Loader: Actors signing new copies of ScreenConnect or tools to download it, exploiting the software's previous certificate handling model.
• Castle Loader and Bat fake Bat: Both initial access tools.

A clear trend emerges: attackers primarily use abused certificates for initial access tools and remote access tools, often precursors to ransomware attacks.

A detailed case study on the Black Basta ransomware gang, based on their leaked chat logs from 2025 (likely a typo, meant 2022 or 2023, given the context of Black Basta activity), provided critical insights. The logs revealed over 100 certificates discussed, with 40 mapped to known malware in the Cert Graveyard. Black Basta frequently kept EV certificates "on standby," readily replacing revoked ones. A particularly telling conversation involved a junior member questioning the high cost of a certificate ($4,000 for an EV cert), to which the "big boss" responded, "Without a cert, it's better not to send anything. This is a mass campaign, not a targeted one." This underscores the immense value attackers place on EV certificates for mass distribution campaigns, as they enable executables and MSI files to bypass browser warnings and operating system rejections, facilitating successful downloads and execution. Attackers like Black Basta were observed using certificates to sign Lumma info stealer, Picabot, and QakBot.

The primary method for acquiring these certificates is malicious compliance, specifically through reselling and impersonation. Research from 2018 ("Issued for Abuse" by University of Maryland) already identified reselling as the main source, a trend that persists today. Attackers impersonate legitimate companies—ranging from well-known brands like McDonald's (successfully) to small software organizations or even open-source projects. They create fake websites using similar templates to establish a semblance of legitimacy, or pay third parties to apply on their behalf.

Technical Deep Dive

▶ Watch: Malicious compliance: Reselling and impersonation of businesses (12:15)

The methods of "malicious compliance" are sophisticated and exploit various facets of the certificate issuance process:

1. Reselling and Impersonation:

• This is the dominant method. Actors, often operating from Russian cybercrime forums, apply for certificates by impersonating real companies.
• The target companies vary: sometimes major brands like McDonald's, sometimes small software developers, or even open-source projects.
• Attackers may also apply in the name of a company that already has a certificate from one CA, but then seek another from a different CA (e.g., a company with a Sectigo cert might have an actor apply for one from DigiCert in its name).
• To aid impersonation, threat actors frequently set up fake websites, often reusing templates with minor modifications to create a convincing, albeit superficial, online presence for their fabricated entity.

1. Shell Companies and Registered Agents:

• Attackers exploit legal loopholes, particularly in the US, using registered agents to create shell companies. These agents can register businesses on behalf of others, sometimes with minimal information from the actual malicious actors, using the agent's own address.
• Wyoming is cited as a state notorious for this, with registered agent buildings hosting hundreds of thousands of organizations, many linked to scams.
• Two key loopholes are abused:
• 3-Year Rule: Certificate validation requirements become more lenient for businesses that have existed for three years. Attackers will often create a shell company and wait for this period to pass before applying.
• Registered Agent Address: CAs are required to validate a physical address. However, if a registered agent receives mail on behalf of the company, the CA's validation often stops there, failing to verify the legitimacy of the underlying organization itself. This lack of deeper scrutiny allows shell companies to pass the physical address check.

1. Manipulated Government Databases:

• CAs rely on government databases to validate organizational existence. There have been claims by CAs that these databases can sometimes be manipulated, leading to validation against false entries.
• A notable incident involved a bug in the Companies House database in the UK, discovered in the past year, which allowed users to manipulate any entry. While this bug was patched, and an investigation by Companies House found no evidence of manipulation for organizations flagged by Expel, it raises questions about similar vulnerabilities in other national databases.

1. Certificate Authority (CA) Compromise:

• While less frequent, direct compromise of CAs represents a significant threat.
• Globalman Case: A threat actor named "Globalman" on Telegram, who used GlobalSign's logo, offered EV certificates with a 5-day turnaround, allowing customers to request specific company names. This highly suspicious speed suggested an internal source within a CA. Globalman's operation ceased earlier in the year after Russian authorities reportedly arrested his former colleagues, strongly implying they were his internal source across multiple CAs.
• DigiCert Compromise: In April, DigiCert suffered a compromise where a threat actor gained access to their systems and intercepted certificates intended for legitimate customers, including major hardware manufacturers like Lenovo. The attacker used these intercepted certificates to sign their own malware. DigiCert's incident report is publicly available on Bugzilla. This brazen attack raises concerns about whether other CAs have been similarly targeted or compromised by the same or different threat actors.

These methods collectively demonstrate a sophisticated, adaptable approach by attackers to circumvent the trust mechanisms of code signing, leveraging both social engineering and technical exploitation.

Demo / Proof of Concept

▶ Watch: Defenders: Training analysts to spot certificate discrepancies (22:00)

While the talk did not feature a live, interactive demonstration or proof of concept performed by the speaker, Aaron Walton effectively illustrated the core concepts and findings through real-world examples and the tools developed by Expel.

A key "proof of concept" presented was a screenshot from VirusTotal showcasing a malware file claiming to be "Adobe Photoshop 2024." However, upon inspection of its code signing certificate, the signer was identified as "Just add water Italian pizza bread pasta mix limited." This stark discrepancy between the claimed software and the signing entity perfectly encapsulated the type of malicious compliance that defenders need to identify. This example served as a visual "demo" of how obviously fraudulent certificates can still bypass operating system trust mechanisms, highlighting the gap in automated and human detection.

Walton also discussed the cert report tool, which is a practical utility developed by Expel to facilitate the reporting of abused certificates. While not a live demo, its description served as an explanation of a functional tool designed to aid defenders. The tool, easily installable via pip install cert report, uses a VirusTotal API key to generate comprehensive reports for Certificate Authorities, streamlining the process of submitting necessary information for certificate revocation. This tool acts as a "proof of concept" for how active participation and automation can combat the problem at scale.

Defensive Implications

▶ Watch: Q&A: Tips for identifying suspicious clean files (28:00)

Addressing the pervasive abuse of code signing certificates requires a multi-pronged defensive strategy focusing on education, active engagement, and robust prevention systems.

1. Education:

• Training Analysts and Machines: It is crucial to train both human analysts and automated security systems to identify discrepancies between a file's metadata (e.g., file name, claimed purpose) and its code signing certificate information. The "Adobe Photoshop 2024" signed by "Just add water Italian pizza bread pasta mix limited" example is a prime illustration.
• Cost vs. Detection: Attackers invest significant resources (e.g., $2,000-$7,000 for an EV certificate, with $4,000 being common) in acquiring these certificates. They do so because they expect low detection rates for their malware. When a file is first found on VirusTotal, it often appears "clean." This means that detecting these discrepancies can yield high value, as it targets malware that actors have gone to great lengths to conceal. Services even exist that sell loaders and certificates together, making early detection critical.

1. Active Roles:

• Building Detections: Abused certificates offer high-priority opportunities to build effective detections. Threat actors frequently iterate, making small changes to their malware to bypass existing detections, but often reuse certificates or acquire new ones through similar means.
• Pivoting on Certificates: Certificates are valuable pivot points for threat hunting. When a malicious certificate is identified, investigating its historical use can uncover other, perhaps previously undetected, malware. This is especially true for certificates that have not yet been revoked and may have been resold or used in multiple campaigns.
• Reporting: Prompt and accurate reporting of abused certificates to CAs is paramount. Once a certificate is revoked, it can no longer be used to sign new malware and, critically, operating systems will explicitly warn users, effectively breaking attacker operations and build cycles. The Cert Graveyard serves as a vital resource, crowdsourcing submissions and handling the reporting process. For those wishing to report themselves, the cert report tool (installable via pip install cert report and requiring a VirusTotal API key) automates the generation of comprehensive reports for CAs, minimizing the administrative burden.

1. Prevention Systems:

• Windows Defender Application Control (WDAC): Implementing application control solutions like WDAC is a strong recommendation. WDAC policies can be configured to leverage code signing certificates, allowing only trusted software to execute. The Cert Graveyard database provides "to-be-signed hashes" for each abused certificate, which can be directly integrated into WDAC policies. This proactive measure prevents malicious files from executing on a system even before they are widely detected by antivirus, getting "ahead of the file actually executing."

In essence, defenders must shift from a reactive stance to a proactive one, understanding the attacker's methods for acquiring trust and implementing controls that challenge that false sense of legitimacy at multiple layers.

Key Takeaways

• Widespread and Evolving Abuse: Code signing certificate abuse is a significant and growing problem, with approximately 2,500 known abused certificates and 70 new ones issued to cybercriminals monthly.
• "Malicious Compliance" is Key: Attackers primarily obtain legitimate-looking certificates not through theft, but via "malicious compliance" methods like impersonation, reselling, exploiting shell companies with registered agents, and occasionally through direct CA compromise.
• High Value for Attackers: Extended Validation (EV) certificates are highly valued by threat actors (costing $2,000-$7,000) because they bypass critical security warnings from browsers and operating systems, enabling mass distribution of malware.
• Discrepancy Detection is Crucial: Defenders must train both human analysts and automated systems to identify discrepancies between a file's claimed identity (e.g., file name, metadata) and the actual signer information on its code signing certificate.
• Active Participation is Essential: Building detections based on known abused certificates, pivoting on certificate data to find new malware, and promptly reporting abused certificates for revocation are critical defensive actions. Tools like the cert report streamline this process.
• Proactive Prevention: Leveraging application control solutions like Windows Defender Application Control (WDAC) with hashes from known malicious certificates can prevent malware execution before it even reaches traditional detection engines.

About the Speaker(s)

Aaron Walton is a Senior Threat Intel Analyst at Expel, a managed security services provider. In addition to his role at Expel, he serves as the official representative of the Cert Graveyard, a volunteer-driven database dedicated to tracking and reporting the abuse of code signing certificates. Walton has been actively tracking code signing certificate abuse for approximately five years, building strong relationships with Certificate Authorities (CAs), Microsoft, and other entities responsible for the code signing ecosystem. His work involves not only collecting and analyzing data on abused certificates but also advocating for improved defensive strategies and reporting mechanisms to combat this persistent threat.