GovRAT, the malware-signing-as-a-service platform in the underground market
InfoArmor security experts discovered GονRAΤ, a platform offered to underground APT groups.
In the past, in various articles, we have explained why digital certificates are so attractive to criminals and intelligence agencies, with one of their most interesting uses being the signature of malware code in order to fool antivirus. Of course, digital certificates are increasingly becoming a valuable commodity in the underground ecosystem, and black markets have started to become increasingly profitable.
A few weeks ago, IBM Security X-Force experts noticed the offering of certificates on the Dark Web with a sales called CaaS (Certificates as a service). Cybercriminals use the Dark Web to sell high-grade code certificates – obtained from trusted certificate authorities – to anyone who is naturally interested in buying them.
The sale of code signing certificates has increased significantly in recent months, a trend also confirmed by a recent analysis conducted by threat intelligence firm InfoArmor.
GονRAΤ is a hacking platform that allows the creation of malware, and comes bundled with digital certificates for code signing. The same digital certificates were initially offered for sale on the black market 'TheRealDeal Market' hosted on the Tor network. GονRAΤ is offered for sale for 1.25 Bitcoin, but experts have noticed that its creator is now only offering it privately.
The GονRAΤ tool digitally signs malicious code with code-signing toolssuch as Microsoft SignTool, WinTrust, and Authenticode technology. Experts believe that the end users who wish to purchase GονRAΤ are APT groups that target political, diplomatic, and military personnel – targets of more than 15 governments around the world.
InfoArmor also reported seven banks, some of which are located in the US, and 30 defense departments that have been targeted by GονRAΤ. It is estimated that more than 100 organizations have been hit by malware created with the GονRAΤ platform since early 2014.
