Deception at Scale: How Malware Abuses Trust
summary
Analysis of VirusTotal data finds 1.1 million signed samples that hold valid certificates at submission, 2.6 million suspicious downloads from >400 Alexa top‑1K domains in 2022, and a curated set of government domains hosting NG‑RAT and webshells used for years. Living‑off‑the‑land binaries rise to ~1.1% of samples, 452 malicious files embed legitimate installers and embedding correlates 98% with malware, and many infections execute Cobalt Strike, mimikatz or bundled CCleaner payloads.
AI-written summary · about
chapters (10)
- 0:00Malware deception techniques
- 1:52Malware abusing certificates
- 6:41Legitimate domains for malware
- 9:12Malware on government sites
- 14:25Malware mimicking icons
- 17:35Malicious URLs with favicons
- 18:43Living-off-the-land binaries
- 20:31Malware as installers
- 26:34Querying VirusTotal
- 29:01Key takeaways
related talks
30mMalicious Code-signing at Scale: How Attackers Impersonate Thousands of Real Businesses
42mKeynote: The Expanding Universe of Cyber Threats
33mYour Silent Software Saboteur: Open Source Malware
47mDetecting and analyzing files-less malware
49mThe State Of Malware From The Eye Of The Tiger
46mSponsored Session: Malicious Package Trends Compared With Malware Evolution
47mWorm Charming: Harvesting Malware Lures for Fun and Profit
31mHacking People’s Mind: When Threat Actors Master Social Engineering