Case study: the update was signed, and that was the problem
A trusted software update that carried a backdoor, worked as a case. Signing proved the build was the vendor's; it proved nothing about what was in it. Eight questions on detection, scope and the uncomfortable part, which is that nothing your endpoint controls were watching for was wrong.
A real campaign, worked as a case. The facts come from the joint advisory CISA
published about it and from MITRE's documentation of the campaign, both linked
at the end.
What happened
An enterprise network management product distributed a software update. The
update was built by the vendor, signed with the vendor's certificate, and
delivered through the vendor's normal channel. Customers installed it, because
that is what you are supposed to do with signed updates from a vendor you have
bought a support contract from.
The build system had been compromised. Malicious code was inserted into the
product during the build, so what the vendor signed was already backdoored. The
signature was valid. The chain of trust worked exactly as designed and
certified a trojanised artifact.
