A security vendor has warned network security teams to use extreme caution when reviewing code-signing certificates after discovering an attempt to spoof one of their certificates to disguise a cyberattack.
In a new blog post, Emsisoft claims that after gaining initial access to a customer’s network, the attackers installed a dual-purpose remote access product called MeshCentral.
It was signed with a certificate named “Emsisoft Server Trusted Network CA” to trick security teams into believing it was legitimately there, the AV vendor said.
“We believe this was done to make the detection of the application appear to be a false positive,” it said. “As it turned out, one of our products was installed and running on a compromised endpoint, so we thought the application supposedly signed by the Emsisoft certificate was safe and allowed-listed. may be taken.”
Emsisoft said the incident demonstrates the need for organizations to be extra vigilant when deciding whether to allow new applications flagged by security tools.
“If an organization approves an application that should not be allowed, an attacker could disable antivirus protection, move laterally within a network, steal data, and ultimately deploy ransomware. I have.
Emsisoft says that if the issuer of a certificate is unknown, the application should be inspected in isolation and only if conclusively proven to be safe and legally installed by an organization. advises.
Kevin Bocek, VP ecosystem and community at Venafi, explained that threat actors are increasingly targeting machine identities due to their high level of trust within networks.
“An attacker understands that being granted trusted access to a company’s systems via a fake machine identity is like being ushered through a digital gateway. , spoofed identities were detected and flagged, but could easily have been overlooked,” he added.
“The continued adoption of cloud-native technologies has introduced a tremendous level of complexity around machine identity management. is more difficult than ever.”
Editorial Credit Icon Image: Piotr Swat / Shutterstock.com
