Project Hyphae
Search

Forged Signatures: Not Just For Troubled Youths Anymore. #Nvidia

Share This Post

As apart of the February 23rd ransomware attack on Nvidia by the Lapsus$ group, two Nvidia code-signing certificates were stolen and being used to sign Malware. The stolen code-signing certificates are expired, however they’re still recognized by Windows. This would allow drivers signed with the stolen codes to be loaded in the operating system. Below are the serial numbers used by the stolen certificates:

  • 43BB437D609866286DD839E1D00309F5
  • 14781bc862e8dc503a559346f5dcc518

Windows Defender Application Control Policies can be used to help mitigate this threat. For more information please see the following link: https://threatpost.com/nvidias-stolen-code-signing-certs-sign-malware/178784/



Reach out to our incident response team for help

More To Explore

Information Security News 3-25-2024

Developer Sues Minnesota Contractor After $735K Payment Disappears Article Link: https://www.constructiondive.com/news/beck-sues-ryan-fsa-title-cybercrime/710708/ Truck-to-Truck Worm Could Infect and Disrupt Entire US Commercial Fleet Article Link: https://www.theregister.com/2024/03/22/boffins_tucktotruck_worm/ NIST’s

Information Security News 3-18-2024

Threat Actors Leaked 70 Million Records Allegedly Stolen From AT&T Article Link: https://securityaffairs.com/160627/data-breach/70m-att-records-leaked.html Former Telecom Manager Admits to Doing SIM Swaps for $1,000 Article Link:

Do You Want to Shore Up Your Defenses?

We're opening our first round of threat hunting engagements to 100 organizations. Sign up or join the wait list here.