[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwk0DkOkFddBRvp2a9atn-H_YTtUBk7DEC9ZmXh4Y_eA":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"4a247e9a-c5f5-4360-855c-d3f463287874","And it was only 2 days ago when I told @SquiblydooBlog about a sample from this APT-Q-27 actors t...","and-it-was-only-2-days-ago-when-i-told-squiblydooblog-about-a-sample-from-this-a-4d2b87","And it was only 2 days ago when I told @SquiblydooBlog about a sample from this APT-Q-27 actors that also was signed using a @digicert given cert that was supposedly given to a Swiss company: \"Brunner Informatik AG is a small Swiss software company, founded in 1985. It develops https:\u002F\u002Ft.co\u002FGjHc3FacLc","A threat researcher discovered that APT-Q-27 actors have been using malware samples signed with legitimate DigiCert certificates issued to Brunner Informatik AG, a small Swiss software company founded in 1985. This indicates potential compromise of the company's code-signing credentials or misuse of legitimately issued certificates to evade detection. The discovery was made just days after the researcher had previously reported on related APT-Q-27 activity.","APT-Q-27 malware sample signed with DigiCert certificate issued to Swiss software company.","https:\u002F\u002Fx.com\u002Fmalwrhunterteam\u002Fstatus\u002F2042906240901107988","https:\u002F\u002Fpbs.twimg.com\u002Fmedia\u002FHFnYzL6akAEKAoF.jpg","2026-04-11T10:02:57+00:00","2026-04-11T11:00:09.054979+00:00",7,[17,20,23,25],{"name":18,"type":19},"APT-Q-27","threat_actor",{"name":21,"type":22},"DigiCert","vendor",{"name":24,"type":22},"Brunner Informatik AG",{"name":26,"type":27},"Code Signing Certificates","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":28,"icon":30,"name":31,"slug":32},null,"Threat Intelligence","threat-intelligence",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[50],{"type":48,"value":51,"context":52},"APT-Q-27 malware samples","Samples signed with DigiCert certificates",[21,24],{"controls":55,"vendors":141},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":86,"name":87,"problem":88,"products":89},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":115,"name":116,"problem":117,"products":118},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[119,125,133],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":152},"apt-group-exploits-legitimate-code-signing-certificates-to-evade-detection","APT Group Exploits Legitimate Code-Signing Certificates to Evade Detection","APT-Q-27 threat actors compromised or misused legitimate DigiCert code-signing certificates belonging to Brunner Informatik AG to sign their malware, allowing malicious code to appear trustworthy to security systems. This supply chain attack demonstrates how attackers can exploit the trust model of digital certificates to bypass security controls that rely on signature verification. The incident highlights critical vulnerabilities in certificate management and the need for enhanced monitoring of code-signing activities, as compromised certificates can enable widespread malware distribution while evading detection.",[147,148,149,150,151],"CIS Control 2","CIS Control 16","NIST SP 800-57","NIST SC-17","ISO 27001 A.14.1.3",{}]