Poisoned Pipeline / Techniques / T0208
Compromise code-signing identity
Artifact Security CI/CD Posture Code Security
The attacker signs malware with a stolen or issuer-trusted code-signing
certificate, CI OIDC identity, or package-registry signing key so that
signature verification succeeds. SolarWinds Orion updates were signed as
SolarWinds. Distinct from spoofed git commits (T0195) and from forging
provenance documents (T0206): here the cryptographic identity is real
and compromised.
Where this idea came from
ShadowHammer/CCleaner signed updates, DAEMON Tools signed binaries; conference: Black Hat USA 2026 briefings on hardware/UEFI (EL2 attack surface, USB wallet AI-assisted exploitation) extend signature-trust attacks.
- https://slsa.dev/spec/v1.0/threats
- https://orangematter.solarwinds.com/2021/05/07/an-investigative-update-of-the-cyberattack/
- https://www.blackhat.com/us-26/briefings/schedule/index.html
Mitigations
- M1860 Implement strong authentication mechanisms
- M1120 Store credentials in vault
- M1530 Use multi-factor authentication
Detections
- D1260 Implement regular security audit and review
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (7)
- Operation ShadowHammer (ASUS Live Update)
- DarkGPT / Codo-AI / bitcoin-auto-trading VS Code extensions
- CCleaner 5.33 signed ShadowPad backdoor
- SolarWinds
- DAEMON Tools signed installers backdoored (Apr–May 2026)
- WIZVERA VeraPort plugin installed malware signed with stolen certificates
- eMudhra intermediate CA keys recoverable in milliseconds; root distrusted