Digitally-Signed Rootkits are Back – A Look at FiveSys and Companions
More than a decade ago, rootkits were the apex predators of cybercrime. These clandestine computer programs were built to offer attackers an uninterrupted foothold onto victims’ computers and conceal malicious activities from the operating system as well as from antimalware solutions.
For the past few months, Bitdefender researchers have seen a surge in malicious drivers with valid digital signatures issued through the WHQL signing process.
This research focuses on FiveSys – a digitally signed rootkit that made its way through the driver certification process.
- Bitdefender researchers have identified a rootkit with a Microsoft-issued digital signature;
- The rootkit is used to proxy traffic to Internet addresses that interest the attackers.
- We assume that the rootkit targets online games with the main goal of credential theft and in-game-purchase hijacking
- The rootkit has been targeting computer users for more than a year now
- Rootkit spreading is limited to China and we presume that it is operated by a threat actor with significant interest in the market.
Indicators of Compromise
An up-to-date and complete list of indicators of compromise is available to Bitdefender Advanced Threat Intelligence users. The currently known indicators of compromise can be found in the whitepaper below.
LuminousMoth – PlugX, File Exfiltration and Persistence Revisited
July 21, 2021
How We Tracked a Threat Group Running an Active Cryptojacking Campaign
July 14, 2021
A Note from the Bitdefender Labs Team on Ransomware and Decryptors
May 26, 2021
New Nebulae Backdoor Linked with the NAIKON Group
April 28, 2021
Good riddance, GandCrab! We’re still fixing the mess you left behind.
June 17, 2019