- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,681
DigiCert changed the rules of file transfer in chats after a hacker attack.
The usual file in the support chat turned out to be a serious problem for DigiCert. The attacker issued a malicious archive for a “clerator screenshot” and managed to get to the systems that are used to produce digital certificates.
The incident is described in отчётеthe report of DigiCert. The attack began on April 2, 2026. An unknown person contacted the support employee through the chat and sent a ZIP archive several times. Inside there was a executed file with a malicious load. The defense mechanisms stopped four attempts, but the fifth worked, and one of the working computers was infected.
A day later, the problem was noticed and isolated the infected system. Then they thought the threat was eliminated. Later it turned out that the attacker managed to gain a foothold on another computer, where the defense worked incorrectly and did not record the invasion.
Having gained access to the internal support portal, the attacker took advantage of the official function. With its help, employees can log into customer accounts to help with the setting. It is impossible to manage accounts or place orders through this function, but it turned out that special initialization codes are available there for code signature certificates.
Such codes together with an already approved order allow you to obtain a ready-made certificate. The attacker took advantage of this opportunity and issued several certificates on behalf of customers. Some of them were then used to sign malware Zhong Stealer.
In total, DigiCert withdrew 60 certificates. Of these, 27 directly related to the actions of the attacker, the rest were canceled just in case. All certificates were invalidated within a day after detection, and the date of the recall indicated the moment of release.
The problem was not in the system of issuing certificates, but in a combination of several factors. On one of the computers, the protection of the end-point level did not work, the support portal showed sensitive data to employees without restrictions, and the initialization codes were not considered full-fledged accounting data and were not hidden.
In addition, it turned out that the support channel allowed you to send files without strict restrictions. Such a mechanism actually became a convenient entry point for attack.
The company has already made changes. Access to initialization codes was closed, the requirements for multifactor authentication were tightened, and the transfer of files in chats was limited. Also check the settings of protective systems to avoid “blind zones”, as is the case with the second infected computer.
DigiCert claims that the attacker did not gain access to other systems and did not interfere with the processes of checking customers. However, history shows that even auxiliary tools within a company can become a critical point if they go through them to release digital certificates.
The usual file in the support chat turned out to be a serious problem for DigiCert. The attacker issued a malicious archive for a “clerator screenshot” and managed to get to the systems that are used to produce digital certificates.
The incident is described in отчётеthe report of DigiCert. The attack began on April 2, 2026. An unknown person contacted the support employee through the chat and sent a ZIP archive several times. Inside there was a executed file with a malicious load. The defense mechanisms stopped four attempts, but the fifth worked, and one of the working computers was infected.
A day later, the problem was noticed and isolated the infected system. Then they thought the threat was eliminated. Later it turned out that the attacker managed to gain a foothold on another computer, where the defense worked incorrectly and did not record the invasion.
Having gained access to the internal support portal, the attacker took advantage of the official function. With its help, employees can log into customer accounts to help with the setting. It is impossible to manage accounts or place orders through this function, but it turned out that special initialization codes are available there for code signature certificates.
Such codes together with an already approved order allow you to obtain a ready-made certificate. The attacker took advantage of this opportunity and issued several certificates on behalf of customers. Some of them were then used to sign malware Zhong Stealer.
In total, DigiCert withdrew 60 certificates. Of these, 27 directly related to the actions of the attacker, the rest were canceled just in case. All certificates were invalidated within a day after detection, and the date of the recall indicated the moment of release.
The problem was not in the system of issuing certificates, but in a combination of several factors. On one of the computers, the protection of the end-point level did not work, the support portal showed sensitive data to employees without restrictions, and the initialization codes were not considered full-fledged accounting data and were not hidden.
In addition, it turned out that the support channel allowed you to send files without strict restrictions. Such a mechanism actually became a convenient entry point for attack.
The company has already made changes. Access to initialization codes was closed, the requirements for multifactor authentication were tightened, and the transfer of files in chats was limited. Also check the settings of protective systems to avoid “blind zones”, as is the case with the second infected computer.
DigiCert claims that the attacker did not gain access to other systems and did not interfere with the processes of checking customers. However, history shows that even auxiliary tools within a company can become a critical point if they go through them to release digital certificates.
