Threats Tagged 'digital signature abuse'

A new campaign by the APT-Q-27 threat actor abuses a valid, unrevoked digital signature from a Chinese technology company to distribute malicious payloads. The attack uses a dropper that fetches modules from command and control infrastructure, leveraging DLL side-loading through a legitimate Tencent-signed executable to execute code. The infrastructure involves Google Cloud Storage and a dedicated domain for C2 operations. Components include an EXE dropper, DLL loader, DAT payload, and the legitimate Tencent executable used for side-loading. No specific affected software versions or patches are identified.