Researchers Map Three TamperedChef-Style Malware Clusters Through Code and Certificate Reuse
Summary
Unit 42 researchers mapped three TamperedChef-style clusters using code-signing, code reuse, advertising and corporate links. They tracked over 4,000 samples and describe fake productivity apps that can activate after long delays to deliver malicious payloads.
Key points
- Researchers tracked more than 4,000 samples across over 100 variants and identified three clusters: CL-CRI-1089, CL-UNK-1090 and CL-UNK-1110.
- They linked campaigns using certificate chains, code similarities, ad transparency data and corporate ownership records; they do not attribute all activity to one author or group.
- The campaigns distribute trojanized productivity apps through malvertising and sponsored search results, often using legitimate-looking websites and code-signing certificates.
- Samples can remain dormant for weeks or months before retrieving second-stage payloads, including RATs, infostealers, proxy tools, adware and browser hijackers.
- The researchers observed persistence through scheduled tasks or registry Run keys, and collection of system information; some campaigns also target browser credentials.
- Recommended responses include removing malicious files and persistence, scanning for second-stage payloads, revoking active tokens, resetting credentials and reviewing access logs.
Article Details
- Attack Vectors
- Malvertising, sponsored search results and search engine marketing direct users to websites distributing trojanized productivity applications.
- The applications use legitimate-looking branding and code signing to appear trustworthy, then may remain dormant for days or weeks before activating.
- After activation, loaders can download and execute additional payloads, including RATs, infostealers, proxy tooling, adware and browser hijackers.
- Persistence is commonly established through scheduled tasks or registry Run keys; some samples obfuscate components and command strings.
- Defensive Notes
- Educate users about the risks of downloading software from advertisements and untrusted sources, even when it appears legitimate.
- Keep endpoint detection and response protections updated and consider enterprise browser protections and endpoint hardening.
- If a device is affected, remove or quarantine associated files, remove scheduled-task and other persistence mechanisms, and run a full malware scan.
- Revoke active user tokens, reset credentials, and review access logs because browser-based credentials may be compromised.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | onezipapp[.]com | Campaign distribution and landing-page domain for the malicious OneZip compression tool. |
| SHA256 | 2231bfa7c7bd4a8ff12568074f83de8e4ec95c226230cccc6616a1a4416de268 | SHA-256 of a RapiDoc binary containing a PDB; the article associates the RapiDoc campaign with CANDY TECH LTD and TamperedChef-style activity. |
| SHA256 | 248de1470771904462c91f146074e49b3d7416844ec143ade53f4ac0487fdb44 | SHA-256 of a RapiDoc binary containing a PDB; the article associates the RapiDoc campaign with CANDY TECH LTD and TamperedChef-style activity. |
| URL | hxxps[:]//www[.]crystalpdf[.]com/conditions | Conditions page on a website the article identifies as distributing TamperedChef-style malicious software. |
MITRE ATT&CK
T1005 · Data from Local SystemInitial information gathering included local system details such as system version, hostname and active browsers.T1016 · System Network Configuration DiscoverySome campaigns collected domain information and geolocation from infected systems.T1027 · Obfuscated Files or InformationLoaders obfuscated malicious components and, in the Calendaromatic campaign, homoglyphs were used to obscure incoming command strings.T1036 · MasqueradingMalware masqueraded as legitimate productivity software, including PDF editors, calendars and file tools.T1041 · Exfiltration Over C2 ChannelThe article reports credential exfiltration alongside continuous command-and-control activity.T1053.005 · Scheduled TaskSamples established persistence by creating scheduled tasks.T1071.001 · Web ProtocolsThe article describes continuous C2 and upstream API use to retrieve and run additional payloads.T1105 · Ingress Tool TransferAfter delayed activation, samples downloaded and executed additional payloads.T1204.002 · Malicious FileUsers were lured by malicious advertisements and search results to download and run trojanized productivity applications.T1547.001 · Registry Run Keys / Startup FolderSamples established persistence through registry Run keys.T1587.001 · MalwareThe article reports malware campaigns with many custom variants and, in some cases, a new codebase for each campaign.
People
Threat Actors
CL-CRI-1089Tracked cluster associated with trojanized productivity-app campaigns, malvertising, credential-focused activity, adware and occasional proxy-style payloads; the researchers describe it as a distinct cluster.CL-UNK-1090Tracked cluster associated with malicious productivity applications distributed through malvertising; the researchers link its operations to advertising and code-signing entities, while noting that its motivations are less clear.CL-UNK-1110Tracked cluster distributing trojanized applications and most commonly associated in the article with the TamperedChef alias; the article treats it as distinct from the other tracked clusters.
Malware
Vendors
Products
AppSuite PDFThese malicious productivity application campaigns include AppSuite PDF, Calendaromatic, JustAskJacky and CrystalPDF.Calendaromatic[File name / archive component ] Calendaromatic sample structure – calendaromatic-win_x64.exe, resources.neu, and 7zSFXCortex XDRCortex XDR and XSIAM help to prevent the threats described in this blog, by employing the Malware Prevention Engine.CrystalPDF[Website / URL ] Distribution and conditions pages referenced for malicious productivity software – hxxps[:]//www.crystalpdf[.]com/conditionsJustAskJackyThese malicious productivity application campaigns include AppSuite PDF, Calendaromatic, JustAskJacky and CrystalPDF.OneBrowserInstalling an entirely new adversary-controlled browser (e.g., OneBrowser)OneZipThe OneZip campaign belonging to the CL-UNK-1090 cluster provides a real-world illustration of how tracking these clusters through advertising commonality and agencies works.Prisma browserPrisma Browser helps to prevent access to known malicious campaigns using Advanced URL Filtering, Advanced Web Protection (Live Page Scanning) which runs AI models within the browser to detect attack patterns, fileXSIAMCortex XDR and XSIAM help to prevent the threats described in this blog, by employing the Malware Prevention Engine.
Countries
IsraelThe data highlights that while Israel and the U.S.MalaysiaThis cluster primarily leveraged companies based out of Ukraine, Malaysia, Singapore, the U.S.SingaporeThis cluster primarily leveraged companies based out of Ukraine, Malaysia, Singapore, the U.S.UkraineThis cluster primarily leveraged companies based out of Ukraine, Malaysia, Singapore, the U.S.United Kingdomand the UK to perform operations. In cases where the owner’s place of birth was recorded by the UK government, all owners were of Ukrainian origin.United StatesThe data highlights that while Israel and the U.S.
Industries
advertisingTwo major clusters, CL-CRI-1089 and CL-UNK-1090, were mapped through code-signing reuse, advertising overlaps, corporate structures, and OSINT.SoftwareThe campaigns use fake productivity software, including PDF editors, calendars, ZIP tools, GIF makers, and file converters, to deliver malicious payloads.