New Threat Actor Fraudulently Buys Digital Certificates to Spread Malware

guest · Sep 16, 2019

New Threat Actor Fraudulently Buys Digital Certificates to Spread Malware
September 16, 2019
https://threatpost.com/threat-actor-buys-digital-certs-spreads-malware/148345/

Researchers have identified a new threat actor that is using impersonation fraud to purchase digital certificates that are then used for the spread of malware.

Security firm ReversingLabs identified a bad actor that deceives certificate authorities into selling them legitimate digital certificates by impersonating company executives, according to a blog post by chief architect and co-founder Tomislav Pericin. Once purchased, the bad actor sells the certificates on the black market for digitally signing malicious files, mainly adware, he said.

“Certificates are valuable resources to threat actors, as their mere presence can reduce the chance of early malware detection,” he wrote. “This is particularly true for financially motivated actors.”

ReversingLabs observed fraudulently obtained certificates being used to sign adware such as OpenSUpdater, an app that can install unwanted software on a client’s machine. While signing adware was the predominant use of the activity the company identified, other types of malware also were distributed using the certificates, researchers said.
Click to expand...

ReversingLabs: Digital Certificates - Models for Trust and Targets for Misuse

Log in or Sign up

New Threat Actor Fraudulently Buys Digital Certificates to Spread Malware

guest Guest

Log in or Sign up

New Threat Actor Fraudulently Buys Digital Certificates to Spread Malware

guest Guest

Useful Searches