Old certificate, new signature: Open-source tools forge signature timestamps on Windows drivers
Summary: Cisco Talos observed threat actors using publicly available open-source tools, HookSignTool and FuckCertVerifyTimeValidity, to forge signature timestamps on Windows kernel-mode drivers and deploy thousands of malicious signed drivers without Microsoft verification. The technique exploits a Windows policy exception that permits drivers signed with non-revoked certificates issued or expired before July 29, 2015, and Microsoft has since blocked all certificates discussed and released an advisory.
Bottom line: A PFX file hosted on GitHub in a fork of FuckCertVerifyTimeValidity contained more than a dozen expired code signing certificates, including ones from the 2015 Hacking Team leaks, that are non-revoked and widely used to sign malicious drivers - meaning the trust anchor your driver signature enforcement relies on may already be in an attacker's hands.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026