And it was only 2 days ago when I told @SquiblydooBlog about a sample from this APT-Q-27 actors t...
APT-Q-27 malware sample signed with DigiCert certificate issued to Swiss software company.
A threat researcher discovered that APT-Q-27 actors have been using malware samples signed with legitimate DigiCert certificates issued to Brunner Informatik AG, a small Swiss software company founded in 1985. This indicates potential compromise of the company's code-signing credentials or misuse of legitimately issued certificates to evade detection. The discovery was made just days after the researcher had previously reported on related APT-Q-27 activity.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DigiCert?
Get an email when a new story names DigiCert, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAPT-Q-27 threat actors compromised or misused legitimate DigiCert code-signing certificates belonging to Brunner Informatik AG to sign their malware, allowing malicious code to appear trustworthy to security systems. This supply chain attack demonstrates how attackers can exploit the trust model of digital certificates to bypass security controls that rely on signature verification. The incident highlights critical vulnerabilities in certificate management and the need for enhanced monitoring of code-signing activities, as compromised certificates can enable widespread malware distribution while evading detection.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — APT-Q-27 malware samples