Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Tracking Tampered Chef Clusters via Certificate and Code Reuse

Summary: Unit 42 documented three distinct TamperedChef-style activity clusters - CL-CRI-1089, CL-UNK-1090 and CL-UNK-1110 - tied to trojanized productivity software such as PDF editors and calendars, with over 4,000 samples and 100 unique variants identified across them. The malware stays dormant for weeks to months, maintains command and control to pull down infostealers, proxy tooling or RATs, and is distributed through malicious ads; code-signing certificate reuse, including certificates from CROWN SKY LLC and MARKET FUSION INNOVATIONS LLC, let researchers link campaigns such as Calendaromatic, PDFPrime and ManualzPDF.

What you should know: Unit 42 observed roughly 12,000 unique instances of this fake productivity software across its customer base, and the operators own both the code-signing companies and the ad agencies in at least one cluster - meaning the certificate and the ad placement that make these downloads look legitimate can be the same actor's property.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related