Stuxnet and stolen certificates

Yesterday, our colleagues from ESET discovered a new version of Stuxnet, which has its driver signed by yet another trusted party – “JMicron Technology Corp.”.

JMicron is a rather well known hardware producer, I’ve myself owned about three or four different computers which had JMicron components inside.

The initial RT certificate was suspicious, but another stolen certificate raises interesting questions.

One possibility here is that both JMicron and Realtek got infected with a trojan such as Zeus, that steals digital certificates. Then, the cybercriminals who got the certificates, either re-sold them on the market or used them by themselves to sign the Stuxnet drivers.

To be honest, the fact that trojans were stealing digital certificates did not really seem that impressive when I have first seen this capability.

Now, coupled with the Stuxnet story, it begins to make sense.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.