[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwp0-pKqWQoPLRCd04OJNEmha1VvoFxHPCgmnBk-FyMw":3},{"article":4,"iocs":37,"watch_terms":49,"solutions":50,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":21},"c880dfa6-7d57-4f92-9844-8f521cf02fec","As usually, @smica83 uploaded a related sample to Bazaar: https:\u002F\u002Ft.co\u002Fjt9HqNOAtA\nActive source u...","as-usually-smica83-uploaded-a-related-sample-to-bazaar-https-t-co-jt9hqnoata-act","As usually, @smica83 uploaded a related sample to Bazaar: https:\u002F\u002Ft.co\u002Fjt9HqNOAtA\nActive source url: https:\u002F\u002Fnebraskatigers.s3.us-east-005.backblazeb2[.]com\u002Fbluebeam\u002FBlueBeam_Revu_0295-latest-x64.exe\n\"Xiamen Yufeng Tiantai Network Co., Ltd.\" (Sectigo given cert) signed...\n🤷‍♂️ https:\u002F\u002Ft.co\u002FlqVrXrwJMs","A malicious executable masquerading as BlueBeam Revu 0295 was discovered hosted on a Backblaze S3 bucket and uploaded to the Bazaar malware repository. The malware is signed with a certificate issued to 'Xiamen Yufeng Tiantai Network Co., Ltd.' by Sectigo, suggesting a supply-chain or certificate abuse vector.","Malware sample disguised as BlueBeam Revu installer uploaded to Bazaar.","https:\u002F\u002Fx.com\u002Fmalwrhunterteam\u002Fstatus\u002F2039266584745722142",null,"2026-04-01T09:00:16+00:00","2026-04-01T10:00:10.042632+00:00",7,[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":17,"icon":12,"name":19,"slug":20},"Malware","malware",[22,27,32],{"category":23},{"id":24,"icon":12,"name":25,"slug":26},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":28},{"id":29,"icon":12,"name":30,"slug":31},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":33},{"id":34,"icon":12,"name":35,"slug":36},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[38,42,46],{"type":39,"value":40,"context":41},"url","https:\u002F\u002Fnebraskatigers.s3.us-east-005.backblazeb2.com\u002Fbluebeam\u002FBlueBeam_Revu_0295-latest-x64.exe","Malicious BlueBeam Revu installer hosted on Backblaze S3",{"type":43,"value":44,"context":45},"domain","backblazeb2.com","S3-like storage service hosting malware payload",{"type":20,"value":47,"context":48},"BlueBeam_Revu_0295-latest-x64.exe (trojanized)","Fake BlueBeam Revu executable with Sectigo certificate abuse",[],{"controls":51,"vendors":134},[52,81,107],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":82,"name":83,"problem":84,"products":85},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[86,92,100],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":87,"product_name":88,"url":90,"description":91},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":101,"product_name":104,"url":105,"description":106},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"slug":108,"name":109,"problem":110,"products":111},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[112,118,126],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":113,"product_name":114,"url":116,"description":117},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"malware-campaign-uses-compromised-code-signing-certificate-to-impersonate-bluebeam-software","Malware Campaign Uses Compromised Code Signing Certificate to Impersonate BlueBeam Software","Attackers successfully deployed malware disguised as legitimate BlueBeam Revu software by abusing a valid code signing certificate from Sectigo. The malware was distributed through cloud storage infrastructure (Backblaze S3), demonstrating how supply chain compromises can leverage trusted certificate authorities to bypass security controls. This incident highlights the critical weakness in certificate-based trust models when certificates are compromised or fraudulently obtained. Organizations must implement additional verification layers beyond certificate validation to protect against sophisticated impersonation attacks.",[140,141,142,143,144],"CIS Control 2.1","CIS Control 8.1","NIST SP 800-161","NIST SC-30","ISO 27036",{}]