Ask Fitis, the Bear: Real Crooks Sign Their Malware
Summary: Krebs on Security traces the hacker 'Megatraffer' to Konstantin Evgenievich Fetisov of Moscow, a veteran Russian cybercriminal who has sold stolen and ill-gotten code-signing certificates since 2015 on forums including Exploit, charging $700 for unique certs and $1,900 for extended validation certs. Leaked Conti ransomware chat logs show Megatraffer working with the gang to code-sign its malware between July and October 2020, and Intel 471 places the actor on more than a half-dozen crime forums from September 2009 to the present.
Bottom line: Code-signing certificates are the trust signal antivirus products and browsers lean on, and one actor has supplied them to malware operators and a major ransomware gang for years at $700 to $1,900 a piece - so a valid signature is not evidence of a trustworthy publisher.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026