DigiCert Revokes 60 Code-Signing Certificates After Support Portal Attack

Summary

DigiCert said attackers used malware and its internal support portal to obtain EV Code Signing certificates. By April 17, it had revoked 60 certificates associated with the incident and canceled pending orders.

Key points

DigiCert said the attack began April 2 with a malicious payload disguised as a screenshot and delivered through a customer chat channel.
The malware infected two endpoints; DigiCert identified them on April 3 and April 14, and attributed the delayed discovery of the second infection to malfunctioning endpoint security solutions.
According to DigiCert, attackers pivoted from an infected system to the internal support portal and accessed initialization codes for approved certificate orders.
By April 17, DigiCert had revoked 60 certificates associated with the incident, including 27 explicitly linked to the threat actor.
DigiCert said 11 certificates reported by the community had been used to sign Zhong Stealer malware.
DigiCert said it found no evidence of misuse of other internal systems; it also canceled pending orders and strengthened access controls, file restrictions, and logging.

Article Details

Victim Organization: DigiCert
Incident Type: Cyberattack involving malware delivered through a customer chat channel, followed by access to DigiCert’s support portal to obtain EV Code Signing certificates.
Data Types Exposed: Initialization codes for pending Code Signing certificate orders
Information about approved orders
Affected Records: DigiCert identified and revoked 60 certificates associated with the incident; 27 were explicitly linked to the threat actor.
Affected Data Size: Unknown
Operational Impact: Malware infected two endpoints. Certificates associated with the incident were revoked, pending orders were canceled, and DigiCert changed security and access controls. DigiCert said it found no evidence of misuse of other internal systems.
Ransom Or Extortion: Unknown
Claim Status: confirmed

Malware

Zhong StealerOf these, 11 were reported by the community and were used to sign the Zhong Stealer malware family, DigiCert says.

Vendors

DigiCertDigiCert last week announced that certificates fraudulently obtained from its internal support portal after a cyberattack were revoked.

Products

Salesforcecodes from proxied support users, restrict the file types that can be sent using support chat and Salesforce case attachments, and improve logging.