The remote access tool that had to revoke its own signature
Attackers reached AnyDesk's production systems in late December 2023 and took source code along with private code-signing keys. AnyDesk detected it during an internal audit in mid-January, brought in CrowdStrike, revoked its certificates and shipped a rebuilt binary on 29 January, disclosing publicly on 2 February; within a day, more than 18,000 AnyDesk credentials were on sale on criminal forums.
What worked
They found it themselves. An internal security audit caught this, not a customer, not a researcher, not an extortion email, and on current numbers most organisations learn about their own breach from somebody else. They then did the expensive right thing rather than the cheap comfortable one: revoked the signing certificates and forced a client update, knowing that would break tooling for every customer and confirm the severity in public.
What failed
A private code-signing key was reachable from a production environment an intruder could get into. That key is not ordinary data; it is the thing that makes your customers' machines trust a binary, and once it leaves it can sign malware that every endpoint in your customer base will accept. The other failure is the arithmetic of the tool itself: AnyDesk exists to give someone remote control of a machine, so a compromise of AnyDesk is a potential compromise of every estate it is installed in, and that concentration was not reflected in how the signing material was held.
The number
18,317
AnyDesk portal credentials listed for sale within a day of the disclosure. Resecurity, who found the listing, attribute them to info-stealer malware on users’ own machines rather than to the breach itself, the rush to sell was the disclosure’s doing, not the source of the credentials.
What to do instead
Keep code-signing keys in an HSM and sign through a service that logs every request, so that a compromised build host can ask for a signature and still never possess the key. Treat that as a hard requirement rather than a maturity goal: it is the specific control that turns this incident from a supply-chain catastrophe into an expensive inconvenience. On the consuming side, inventory your remote access tools and know which vendor can reach your estate, because their incident is your incident, and the version pinning that protects you here has to be decided before their disclosure lands, not after.