Attack Chain

1. The threat actor contacted DigiCert's support team via a customer chat channel.
2. A ZIP file disguised as a customer screenshot, containing a malicious .scr executable payload, was delivered.
3. A DigiCert support analyst executed the malicious payload on their workstation, leading to system compromise.
4. The threat actor gained unauthorized access to DigiCert's internal support portal through the compromised workstation.
5. A limited function within the support portal was exploited to access initialization codes for approved but pending EV Code Signing certificate orders.
6. Approximately 60 EV Code Signing certificates were obtained and stolen from DigiCert, GoGetSSL, and Verokey certificate authorities.
7. At least 27 of the stolen certificates were weaponized by the threat actor to sign Golden Gh0st RAT and Zhong Stealer malware artifacts.
8. The digitally signed Golden Gh0st RAT malware was then distributed through various means, including phishing emails and masquerading as legitimate software, to targeted organizations for further compromise and data exfiltration.

Impact

The breach resulted in DigiCert revoking 60 code-signing certificates, with 27 explicitly linked to the threat actor and used to sign malware artifacts such as Zhong Stealer. This incident undermines trust in the code-signing infrastructure. Successful compromise by Golden Gh0st RAT can lead to extensive data theft from applications like Skype, Google Chrome, Mozilla Firefox, 360 Secure Browser, 360 Speed Browser, and Tencent QQ Browser. The malware establishes persistence, sets up SOCKS proxy tunnels, suppresses display output, logs keystrokes, takes screenshots, enumerates processes, executes shell commands, drops additional payloads, and clears Windows Event logs, enabling comprehensive control and surveillance of the victim's system. The primary targets include finance organizations in the Asia-Pacific region, as well as companies in the gambling, gaming, and Web3 sectors.

Recommendation

• Educate support staff on the risks of executing suspicious attachments, especially .scr executables, received through chat channels or emails to activate Detect Suspicious .scr Executable Execution.
• Deploy endpoint detection rules for unusual process activity, specifically focusing on Detect Windows Event Log Clearing by 'wevtutil cl'.
• Implement strict application allowlisting to prevent the execution of unauthorized .scr files or other executables that could lead to DLL side-loading.
• Review and enhance access controls for internal portals, especially those granting access to sensitive functions like certificate issuance.
• Monitor certificate transparency logs for newly issued or revoked certificates to identify suspicious activity.
• Implement proactive threat hunting for behaviors associated with Golden Gh0st RAT, such as keylogging, screen capture, and unusual outbound network connections.