Securing the gaming culture of cultures

The Deputy CISO blog series is where Microsoft Deputy Chief Information Security Officers (CISOs) share their thoughts on what is most important in their respective domains. In this series, you will get practical advice, tactics to start (and stop) deploying, forward-looking commentary on where the industry is going, and more. In this article, Aaron Zollman, Vice President and Deputy CISO for Gaming at Microsoft discusses the unique challenges and rewards of securing gaming.

There are more than 500 million monthly active players¹ across Xbox consoles, PC, handheld, and more through Xbox cloud gaming. They’re the folks who come to mind when people refer to “gaming culture.” But they’re not really the whole story. Globally, more than 3 billion people engage with gaming.² The majority of these people are gamers, but the number also includes developers working for independent gaming studios, engineers supporting the Xbox platform, and the security and operations professionals that support them all.

In my role as Deputy CISO for Gaming at Microsoft, it’s this much larger, much more complex community that I have to take into account. My team and I aren’t tasked solely with protecting consoles or player accounts. We’re safeguarding intellectual property (IP), live operations, and the trust of billions of interactions. We’re also partnering on risks that range from cheating and monetization exploits to supply chain vulnerabilities and regulatory compliance for child safety and privacy.

Gaming isn’t really a single culture, but rather a culture of cultures—each with their own risk factors to account for. At the heart of gaming is the player experience—their need for seamless access, low latency, and frictionless, immersive experiences. This goes hand-in-hand with privacy and safety in a world where cyberattackers could target well-known players. But aside from those basic needs, players form their own tribes, and a diverse, global player base requires a different approach—which makes securing gaming unique. You don’t approach it like you might traditional enterprise. Studios operate with creative autonomy, platforms demand global scale and low latency, and players expect frictionless experiences. That diversity makes gaming vibrant while also creating unique security challenges.

Each culture comes with its own security risks

Let’s first take a look at the risks that most often appear with each of the overlapping cultures that make up the world of gaming:

Platforms, underpinning services like Xbox Game Pass and Xbox Cloud Gaming, require centralized infrastructure with high availability. Here, security must integrate seamlessly with identity systems and Microsoft-wide standards without slowing down gameplay. But platforms face a number of distinct risks.

The complexity of platforms makes them a rich target for financially-motivated cyberattackers seeking to take over top accounts—or send targeted messages to individuals in an environment where they aren’t expecting phishing, which can threaten both ecosystem trust and commercial strategy. And because platforms serve as the connective tissue between devices, we have to pay special attention to weaknesses in integration points.

We also contend with fraud and abuse in commerce systems, where bad actors attempt to manipulate in-game economies or exploit payment flows. These persistent cyberthreats require layered defenses, real-time monitoring, and rapid responses.

Learn more about Microsoft identity and access solutions

Game development studios, whether they are AAA giants, indie teams, or sole developers, thrive on flexibility. Their environments are highly individualized and frequently blend proprietary tools with third-party assets and co-development with partners. My job is to make sure they can innovate securely—balancing their creative freedom with governance and compliance timelines. But this flexibility introduces risks that look very different from experienced by centralized platforms.

On the plus side, studios’ independence creates smaller failure domains, leaving them free to make their own choices and experiment with new tools, partners and engineering practices, without putting the broader platform and peer studios at risk. But reputation, regulatory liability, and cyberattacker interest can’t be firewalled off so easily. So, we need to establish a baseline of controls and detect anomalies early, closing down blind spots—despite fragmented development environments and third-party risk from studios that rely on external contractors, middleware providers, and asset marketplaces.

And some of the cyberattacks are the same: Without tight identity governance, credential sprawl can create highly-privileged accounts that become prime targets for threat actors. Studios operate under tight deadlines and with small margins, so we need empathy for their desire to make things easier—and to avoid security checks when under milestone pressure—despite the risk those actions could cause to production.

It’s also important to note that the driving factor for many threat actors targeting studios is the incredibly high value of unreleased IP. For the same reason, social engineering and insider threats are a constant risk for studios.

Explore Microsoft data governance solutions

Studio Central Teams provide shared IT and infrastructure support. They’re the bridge between creative teams and operational security, ensuring that artists, producers, and marketers work in environments that are both productive and resilient. But that role comes with its own set of risks, which are often hidden in the complexity of shared services.

When central teams support diverse projects, maintaining consistent security baselines across cloud resources, build servers, and collaboration tools becomes difficult. Failing to maintain security consistency can lead to configuration drift—where a single misconfigured storage bucket or firewall rule can expose critical assets. But because central teams manage shared infrastructure, they are risk-averse to changes, including some critical security patches, that could cause cascading production failures.

These central teams can be security’s best partners for implementing strong monitoring and segmentation—but also need to be governed to avoid insider risk and toxic combinations of overlapping permissions.

Collaboration over control

Security in gaming isn’t about imposing rules. It’s more about partnership. I work closely with Temi Adabambo, General Manager for Gaming Security, Microsoft, and Eric Mourinho, Chief Architect, Microsoft, to co-develop secure environments and shared tooling. Governance is a dialogue. We collaborate between platform teams, studio IT, security architects, and technical directors in game studios. That’s how we manage exception handling, cross-team dependencies, and the tension between creative speed and security rigor.

One of the advantages of the Microsoft environment is the access it grants us to a security ecosystem that scales globally. In gaming, we build upon that foundation, adapting it for the unique needs of developers, platforms, and players:

• Identity and access management: We use Microsoft Entra ID to secure identities across Xbox Live, Game Pass, and studio environments. Shared identity systems allow frictionless sign-in for players while enforcing strong authentication for developers and partners.
• Compliance and governance: We rely on a combination of tools and processes to manage sensitive data and meet regulatory obligations across environments like public cloud infrastructure and bespoke studio setups. This includes Microsoft Purview for data classification and compliance monitoring, Microsoft Defender for Cloud for policy enforcement and resource hardening, Entra ID for identity governance, and Microsoft Sentinel for audit and reporting. Together, these capabilities help us maintain visibility, enforce standards, and respond quickly to compliance exceptions without slowing down development.
• Threat intelligence and detection: With Microsoft Defender for Cloud, Microsoft Sentinel, and proprietary Microsoft tooling, we gain visibility into cyberthreats across platforms and supply chains. These tools allow us to detect anomalies, respond quickly, and share intelligence across teams without slowing down creative workflows.
• Secure development lifecycles: We embed security into game development through automated code scanning, vulnerability management, and secure build pipelines, helping studios ship faster without sacrificing safety.

These are enterprise-grade capabilities, adapted to the needs of the global gaming culture of cultures. They allow us to protect billions of interactions while enabling the creativity that defines this industry. 

Looking ahead 

Gaming will only grow more complex. But I see that as an opportunity. Security presents challenges, but in facing those challenges head-on, we are constantly refining our practices, products, and player experiences. When we design for resilience, we protect not just games but the communities that help them thrive.

For Microsoft, that means treating gaming security as an ever-evolving system—one that changes with each new iteration of technology, player expectations, and the creative heartbeat of the industry.

Security teams and their families are gamers too. Visit the Xbox Wire and our recent blog post for Safer Internet Day to learn more about how we keep players and communities safe and secure at Xbox.

Microsoft
Deputy CISOs

To hear more from Microsoft Deputy CISOs, check out the OCISO blog series:

To stay on top of important security industry updates, explore resources specifically designed for CISOs, and learn best practices for improving your organization’s security posture, join the Microsoft CISO Digest distribution list.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

---

¹Microsoft FY25 Fourth Quarter Earnings Conference Call  

²Microsoft to acquire Activision Blizzard to bring the joy and community of gaming to everyone, across every device 

The post Securing the gaming culture of cultures appeared first on Microsoft Security Blog.

from Microsoft Security Blog https://ift.tt/gC9EAur
via IFTTT

What is data gravity? A practical 2026 guide

Nobody plans for data gravity. We’ve watched teams discover, the hard way, that their “temporary” data lake has become the permanent center of the universe because five years of API integrations, security policies, and ad-hoc analytics pipelines all point at the same storage account. At that point the only real question is whether you move the data to the workload or the workload to the data.

Today, AI clusters and edge sprawl are pulling in one direction while sovereignty rules pull in another, and that question gets expensive fast.

What is data gravity?

Dave McCrory coined the term in 2010, and the physics metaphor still holds. As data accumulates, it becomes harder to move because live workflows depend on it. Integrations, APIs, pipelines, security controls, and dependent services form around it. Eventually the environment turns into a gravity well, and architecture decisions stop being neutral. The database, data lake, object store, or edge site you chose several years ago is now deciding where the next workload runs. You might think you’re choosing infrastructure freely, but at scale your existing data often makes that decision for you.

So data gravity is bigger than storage. It influences cloud strategy, AI adoption, backup design, disaster recovery, network planning, compliance, and vendor management. Once you see it, you can’t unsee it. I’ve always thought McCrory’s metaphor is the best one-sentence explanation of why enterprise architecture drifts the way it does.

Why 2026 is different

What changed? Scale, distribution, and the fact that enterprise data has become strategic in ways it wasn’t five years ago. AI initiatives are the most obvious accelerator. Modern AI systems need internal documents, transaction data, telemetry streams, images, logs, and historical datasets. Moving all of that into a separate AI platform is slow, expensive, or sometimes simply isn’t allowed. The result is that organizations are putting GPUs, inference servers, and RAG pipelines closer to existing datasets instead of centralizing the data elsewhere. That’s a real shift in how infrastructure gets planned. We’ve all seen the AI hype cycles, but this one actually changes where you rack the hardware.

Cloud economics add their own pressure. Most cloud providers make inbound transfers cheap or free, but cross-region replication, inter-cloud transfers, and outbound movement can become costly at scale. The challenge isn’t limited to bandwidth charges. Large migrations also require validation, orchestration, downtime planning, rollback procedures, and application reconfiguration. A 20 TB environment may still feel portable. Multi-petabyte environments usually don’t.

Edge data keeps piling up in factories, hospitals, stores, vehicles, and branch offices. Transmitting every raw event to a centralized platform is often inefficient or technically unnecessary. Organizations increasingly process data locally, keeping only summarized or filtered outputs for centralized retention.

Sovereignty rules add a legal layer on top of the physical and economic ones. Frameworks such as GDPR, the EU Data Act, and India’s Digital Personal Data Protection (DPDP) Act have turned data location into a core architectural constraint. Data residency and cross-border transfer restrictions now directly influence where infrastructure goes.

How data gravity works

Four primary forces produce data gravity: volume, latency, bandwidth, and governance. They don’t show up evenly, and most teams hit one of them well before the others.

Volume is the most visible factor. The bigger the dataset, the harder it is to copy, replicate, migrate, restore, or validate. It also tends to be the force that gets noticed last, because growth is slow until it isn’t.

Latency is usually the next one to bite. Fraud detection platforms, industrial control systems, medical imaging workflows, and AI inference pipelines all require low-latency access to operational data. Even small delays can violate response targets. I’ve seen teams hit the latency wall when they tried to run inference against a data lake three regions away, and the round-trip time alone blew their SLA.

Bandwidth is the physical wall behind that. A transfer may be technically possible, but the available throughput may not support completion within your maintenance windows or recovery objectives.

Governance introduces an entirely different class of restriction. Legal obligations or internal policies may prohibit data from leaving a region, tenant, facility, or cloud platform altogether. Unlike bandwidth or latency, governance constraints can’t be solved with more engineering.

A manufacturing environment illustrates these forces clearly. Modern production facilities can generate tens of terabytes of telemetry and machine data every day. Sending every raw event to a centralized cloud platform increases latency, consumes network capacity, and may create compliance concerns. So most architectures process data locally: filtering streams, running inference, detecting anomalies, maintaining short-term history near the source, and forwarding only summarized insights upstream. Once you start looking for these patterns, you see data gravity almost everywhere in modern infrastructure design.

When gravity helps and when it hurts

Data gravity isn’t necessarily a problem. Concentrated data makes a platform more useful at scale. When data is in one place, teams can govern it consistently. Security policies are easier to enforce, access control is more predictable, and analytics teams avoid reconciling conflicting copies of the same information across departments. AI initiatives benefit from more complete training and retrieval datasets, while backup and retention policies become easier to standardize.

The trouble starts when that same concentration gets hard to change. A multi-petabyte data lake may become too expensive to relocate. Applications depend on local latency characteristics. APIs, indexes, pipelines, reports, and backup jobs are all designed around the assumption that the data stays put. At that point, gravity constrains you. Migrations slow down. Cloud exit costs increase. Multi-cloud strategies become harder to execute, and vendor lock-in becomes a long-term operational concern. The same centralization that once improved governance can eventually reduce architectural agility.

This is usually the moment when organizations realize they are no longer simply managing infrastructure, but the consequences of years of accumulated data placement decisions. The objective becomes controlling where data gravity forms and how strongly it influences future decisions.

The egress problem

Cloud egress pricing is one of the clearest economic manifestations of data gravity. Public cloud platforms generally make inbound data transfers inexpensive, but outbound movement is treated very differently. At smaller scale, egress costs may appear negligible. At enterprise scale, they’re part of migration planning. At petabyte scale, even a few cents per gigabyte can turn a one-time transfer into a five-figure invoice before you’ve even started budgeting for engineering time, validation, downtime, and rehydration.

The provider invoice is also only part of the cost. You still need to verify data integrity, retune pipelines, redo access control, reconfigure applications, and plan a rollback path in case the migration fails. I used to ignore the egress line item until I saw it eclipse the compute bill.

None of this means cloud adoption is the wrong strategy. For many workloads, public cloud infrastructure remains the right operational and economic choice. The important point is that datasets rarely remain small indefinitely. Evaluating placement strategy, growth patterns, access behavior, and exit planning early gives you a lot more architectural flexibility later.

Data gravity at the edge

Edge environments produce smaller gravity wells distributed across the infrastructure map. A factory, hospital, retail store, or vehicle fleet generates data right next to the machines, sensors, cameras, or users it’s coming from. Shipping every raw event back to a central data center is often too slow, too expensive, or just unnecessary. As a result, edge architectures increasingly process data locally.

Inference, filtering, compression, aggregation, anomaly detection, and short-term storage all happen near the source. The central platform only gets the selected outputs: alerts, summaries, model updates, and anything that needs long-term retention. You see this pattern in manufacturing, retail video analytics, healthcare imaging, logistics, energy, and automotive. Edge data gravity is a big reason compute and storage are moving closer to where the data is created. I visited a plant last year where the edge cluster had become the de facto production environment because the WAN link couldn’t handle the camera feeds. (This is also why the smart money stopped predicting the death of on-prem storage back in 2019, but that’s an argument for another day.)

Data gravity in the AI era

AI intensifies data gravity because modern AI systems depend heavily on direct access to trusted operational data. Training, fine-tuning, retrieval, and inference workflows all become more effective when they can interact with authoritative datasets directly. The more sensitive or regulated that data becomes, the less practical it’s to export into a separate AI environment.

Retrieval-augmented generation is the clearest case. A RAG system needs to reach documents, databases, file shares, ticket histories, and internal knowledge bases. Pulling all of that into a new AI platform creates security, governance, latency, and duplication issues. In a lot of setups, the cleaner answer is to bring the AI layer to the governed data sources instead.

That changes the infrastructure conversation. Instead of focusing only on where compute resources are cheapest, organizations increasingly ask where compute can access data securely, efficiently, and with acceptable latency. This shift is why GPUs, inference servers, and AI services are now being deployed alongside existing data lakes, object stores, warehouses, and edge storage platforms. We learned that lesson while trying to build a RAG prototype against a locked-down ERP database. The security team wouldn’t let us export the schema – I think their exact words were “over our dead bodies” – so we ended up colocating the inference box in the same VLAN. It was messier than the architecture diagrams suggested. Actually, the diagrams never mentioned the VLAN limit at all.

Data gravity vs data sovereignty

Data gravity and data sovereignty are closely related, but they solve different problems. Gravity itself is a physical, operational, and economic constraint. Sovereignty is a legal and regulatory one. One makes data difficult to move efficiently. The other can make moving it restricted or outright prohibited.

This distinction matters because many infrastructure teams discover too late that solving the technical side of data movement doesn’t automatically solve the compliance side.

 

Dimension	Data gravity	Data sovereignty
Type of constraint	Physical and economic	Legal and regulatory
Main cause	Dataset size, latency, bandwidth, transfer cost	Jurisdictional law, sector rules, contracts
What it limits	Practical movement of data and workloads	Permitted location of data
Typical response	Hybrid architecture, edge processing, federated analytics, repatriation	Regional deployments, tenant isolation, in-country storage
Example	A multi-petabyte data lake too costly to migrate	EU personal data governed by GDPR and the EU Data Act

 

In production environments, these two forces usually reinforce each other. Sovereignty requirements keep data inside a jurisdiction or national boundary. As the amount of data grows, analytics platforms, AI services, backup systems, and dependent applications naturally move closer to it. Over time, the legal boundary becomes an architectural boundary as well. I once watched a compliance officer block a migration because the target region was three miles over a border. The map said it was fine. Their contract didn’t.

How to manage data gravity

You can’t eliminate data gravity, but you can design infrastructure in ways that reduce its operational impact. What matters is starting before the dataset becomes too large or too regulated to move efficiently.

 

Figure 1: Data gravity forming process and mitigation

 

The first step is visibility. Map your critical datasets, identify which applications depend on them, and estimate how quickly they are growing. Model migration costs early, including not only transfer fees but also engineering time, validation procedures, downtime planning, backup redesign, application dependencies, and rollback requirements. A useful planning exercise is to ask yourself: if this dataset grows 10x in the next three years, would your current architecture still be practical to migrate or reorganize?

You also need to separate workloads by latency sensitivity. Not every application requires local access to data. Some workloads tolerate distance well, while others depend on near-real-time response times. Understanding that difference is critical for placement decisions.

Data tiering remains one of the most effective operational controls. Hot data should stay close to active compute resources. Warm data can move into lower-cost but still accessible storage tiers. Cold data belongs in archival platforms, provided recovery times still align with business and compliance requirements.

At the edge, local processing reduces bandwidth consumption and minimizes unnecessary upstream transfers. In hybrid architectures, you should select resources based on workload behavior, latency requirements, governance constraints, and operational economics – not simply because the organization standardized on one deployment model years ago. I start every data migration review with one question: can we still move this in three years without a board-level budget request? (I skipped that question once in 2021 and we spent eleven months – plus a board presentation – unwinding a 400-TB warehouse the client had “temporarily” parked in a deprecated region.) If the answer’s no, we need to talk about tiering or splitting the dataset now.

Where should compute run?

 

Placement	Best fit	Watch out for	Data gravity angle
Cloud	Elastic analytics, SaaS integration, variable demand	Egress, region choice, long-term storage cost	Works best when data can live there long term
On-premises	Regulated data, predictable workloads, low-latency apps	Capacity planning, hardware lifecycle	Keeps compute close to controlled data
Edge	Sensor data, video, local inference, disconnected sites	Operations across many locations	Processes data before it moves upstream
Hybrid	Mixed cloud, on-prem, and edge needs	Governance and tool sprawl	Puts each workload near its most important data

 

If your workloads constantly move data across environments just to function, that’s usually a sign the placement model needs rethinking.

The role of HCI and on-premises storage

For organizations that keep gravity-sensitive workloads on-prem, the main challenge is keeping compute close to the data without adding infrastructure layers you don’t need.

Hyperconverged infrastructure (HCI) fits that pattern because it combines compute and storage resources within the same environment, which can help reduce latency and simplify operations for workloads that can’t easily move to the cloud.

StarWind Virtual SAN (VSAN) supports this model by pooling the local storage of hypervisor hosts into highly available shared storage for HCI clusters. From a data gravity perspective, this allows organizations to keep applications physically close to operational data while avoiding the cost and complexity of separate SAN infrastructure. Teams looking for a preconfigured deployment model can also use StarWind HCI Appliance (HCA) as a ready-to-deploy HCI platform.

Object storage platforms are increasingly important as datasets grow beyond traditional VM-centric infrastructure patterns. DataCore Swarm is designed for large-scale distributed object storage environments where unstructured data, archival content, AI datasets, media repositories, and edge-generated data continue expanding over time. Architectures like this help organizations scale storage horizontally while keeping data accessible across distributed environments without relying exclusively on centralized cloud repositories. I find HCI most useful when the alternative is explaining to a CFO why you need another storage array just to keep the VMs near the data.

FAQ

Why is data gravity important in 2026?

AI adoption, edge data growth, cloud egress costs, and sovereignty rules have all turned data location into an architectural decision. Where the data lives now drives where compute, analytics, backup, and AI infrastructure get deployed.

How does data gravity affect cloud strategy?

It complicates migration, multi-cloud design, and repatriation. Once large datasets pile up in one provider, moving them can mean high transfer costs, long migration windows, and a lot of validation work.

Is data gravity the same as vendor lock-in?

No. Lock-in is one possible outcome of data gravity, but gravity is broader. It includes size, latency, bandwidth, cost, governance, and legal constraints.

How does AI increase data gravity?

AI workloads need access to large volumes of trusted data. Training, fine-tuning, retrieval, and inference all work better when compute sits close to the governed data sources.

What’s the difference between data gravity and data sovereignty?

Gravity is a physical and economic constraint. Sovereignty is a legal one. Gravity makes data hard to move. Sovereignty can make moving it not allowed in the first place.

How can organizations reduce data gravity risks?

Organizations can reduce risk by mapping critical datasets, forecasting growth, modeling migration costs early, tiering storage, processing data locally at the edge, aligning compute placement with data locality, and defining realistic exit strategies before datasets become too large to move efficiently.

Why is HCI useful for managing data gravity?

HCI puts compute and storage in the same cluster, which keeps workloads close to data, cuts latency, simplifies on-prem deployments, and supports edge or regulated environments where shipping data to a distant platform isn’t realistic.

Final thoughts

If you’re still treating data placement as a secondary decision that can be fixed later, you’re setting yourself up for a very expensive surprise. We’ve watched teams spend more on a single egress migration than they would have spent on a couple of months of careful upfront planning. The hard truth is that your data will outlast your current platform, your current vendor, and probably your current job. Design for that. Keep compute flexible, keep data portable where governance allows, and never assume that the cheapest place to store something today is going to be the cheapest place to move it from tomorrow. Gravity is not a bug. It’s physics. Plan accordingly.

from StarWind Blog https://ift.tt/07Jhq4x
via IFTTT

Agent AI is Coming. Are You Ready?

New Industry Data Just Released Suggests Not.

On May 19th, 2026, Orchid Security released the results of our Identity Gap: Snapshot 2026. Among the findings, "identity dark matter" (the unseen, unmanaged elements of identity) now overshadows the visible elements 57% vs. 43%. And it couldn't have occurred at a worse time, with enterprises embracing Agent AI with both arms (and unfortunately, as Orchid co-founder Robert Wiseman explains, more than one eye closed). 

Why the concern, you may ask?

AI agents are shortcut-seekers by design. When given a task, they are trained to find the most efficient way to complete it, with the speed of machines and the creativity of humans. Denied access to a necessary system? Use a hard-coded credential stored in plaintext within the application. Need information they aren't entitled to read? "Borrow" a credential with higher privilege. Constantly being challenged across many different systems? Grab a broadly accepted token. Truly, Agent AI's creativity is remarkable. It just cuts both ways.

Just because an AI Agent can find a way to access an application, a system, a database, doesn't mean that they should do so. But where coding would restrict a traditional nonhuman actor and conscience should give a human pause, in most cases, AI Agents have no such constraints or compunctions.

That's why well-managed identity and access management is a critical foundation to keeping Agent AI activity within authorized bounds. Look no further than the cloud outages reported at the start of the year to understand this importance.

Of course, IAM shortcuts, gaps, and exceptions have built up over the years. Even decades. So it's not reasonable to expect everything to be cleaned up at once. That's why the findings from this year's Identity Gap Snapshot- the exposures most common across North American and European enterprises- are so important and timely.

Top 3 Findings

1. Invisible Non-Human Accounts: Two out of every three nonhuman accounts are set up locally in the application itself. That makes them unseen and unmanaged by the central IAM program. Understandable for machine and service accounts. Dangerous for autonomous AI agents.
2. Excessive Permissions: Seventy percent of all applications have an excessive number of privileged accounts. Far more than expected in the area of "least privilege" access and a major risk given today's threat actors, as well as those AI agents mentioned above.
3. Orphan Accounts: Forty percent of all accounts, across enterprise environments, were found to have outlived their authorized user. These "orphan" accounts are clearly unmanaged and likely unseen, and are ripe for the picking by threat actors and AI agents.

Those are just a few highlights from the full Identity Gap Snapshot. We encourage you to read the full report.

What You Can Do

If you are uncertain about how to address these (and similar) issues within your organization, or even how prevalent each one might be in your environment, our security researcher team has also published an Identity Security Readiness Checklist. If your organization is preparing for (or already participating in) the Agent AI transformation, the time to act is now.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/OlITN1b
via IFTTT

Sentinels League 2026: Live Rankings for the Threat Hunting World Championship

The Threat Hunting World Championship is back — bigger, bolding, and with more on the line than ever. Sentinels League 2026, presented by SentinelOne® in partnership with DropZone AI, Google Cloud, and Mimecast, now is open for entries, and the best threat hunters on the planet are already sharpening their edge.

This year’s championship brings a new 30-minute game format, a $100,000 prize pool, and one of the most demanding tests in cybersecurity competition. If you hunt threats for a living, or you want to prove you can, this is where you belong.

Bookmark this blog post to check your position, track the movement each week, and jump into the next qualifier if you’re not on the board yet.

What Is The Sentinels League?

Sentinels League is SentinelOne’s global threat hunting competition — a multi-stage championship that runs from June through October 2026, culminating live at OneCon in Las Vegas.

Every game is grounded in real-world attack patterns, real detection logic, and real operational pressure. Players go head-to-head across four attack surfaces: Endpoint, Cloud, SIEM, and AI and capture flags of varying difficulty in high-intensity 30-minute qualifiers that test the exact skills defenders use in the field every day.

From June through August, qualifying games run online and in-person across the globe. The top 200 players per region then climb their Sentinels League standings and advance to the Regional Finals. Finally, three regional champions earn an all-expenses-paid trip to OneCon in Las Vegas for the Grand Final where one player is crowned Threat Hunting World Champion 2026.

Four Surfaces. One Championship.

• Endpoint — Hunt down and remediate vulnerabilities in scenarios drawn directly from real incident data.
• Cloud — Track and eliminate threats across cloud-based attack surfaces under time pressure.
• SIEM — Assert your detection dominance in real-time hunting and remediation challenges.
• AI — Go up against AI-generated threats and leverage AI-powered tools in scenarios built from the latest attack campaigns.

You can enter each surface once across the qualifying season. Your combined score is what earns your place in the standings.

What You’re Playing For

Over $100,000 in prizes is distributed across every stage of the competition from the first qualifier through to the Grand Final.

In each online qualifier, payouts begin at first place and run all the way to 15th. First place takes $200, second takes $150, and the third, $100. Everyone from 4th to 15th walks away with $75. In total, there are 48 qualifiers in the season and every one of them pays.

Reach the Regional Finals and the stakes sharpen considerably. First place in your region is worth $2,500, with prizes distributed through to 15th place. For the three regional champions that make it to Las Vegas and the Grand Final, you’re competing for a $5,000 first prize, a portion donated to the charity of your choice through the S Foundation, and the trophy that belongs to only one person in the world.

The Road to Las Vegas

Qualifying Stage | June–August

Play each surface once across 40+ online and in-person qualifiers across the globe and combine your scores. In this stage, the Top 200 per region will advance to Regionals.

Regional Finals | September

Tune in for the online showdown of the best hunters from each region — Americas, Europe, and Asia. From here, three regional champions progress to the Grand Final.

Grand Final at OneCon in Las Vegas | October

Three finalists, one stage. The World Champion is crowned live at OneCon26 and takes home the title, the trophy, and the grand prize.

Sentinels League Standings

Standings update weekly throughout the qualifying season. Bookmark this page and check back every week to track your climb and see who’s gunning for your spot. The Top 200 per region advance to the Regional Finals.

Full standings will become available here once qualifying begins in June.

Beyond the Competition

Sentinels League was built for one reason: To test real defenders in real-world scenarios and reward the best.

The skills you sharpen in a 30-minute qualifier are the same skills that matter when a real attack lands. Every flag hunted and every second against the clock all translate to what cyber defenders do every day. That’s what makes this championship different from anything else in the industry.

The community that showed up last year was extraordinary — thousands of hunters from dozens of countries joined a high-stakes competition with both skill and integrity. This year, the field is set to be bigger, the format harder, the rewards greater.

While only one player will leave Las Vegas as World Champion, every player who enters leaves sharper.

Save Your Spot in the Sentinel Leagues 2026

Registration is now open with qualifiers beginning in June. Visit sentinelone.com/lp/threat-hunting-championship to secure your spot and review the full schedule. Make sure you track the Sentinels League standings on this blog as they update weekly throughout the season. The threats are real. Glory awaits. Good luck, and good hunting!

Participation is open worldwide, but prize eligibility and participation requirements are subject to the Contest Terms & Conditions — some jurisdictions are not eligible to receive monetary rewards or any other prizes. See the full rules at sentinelone.com/lp/threat-hunting-championship/ for details.

The Ultimate Threat Hunting Test

Join the Sentinels League — The 2026 World Threat Hunting Championships Are Here

Register Now

from SentinelOne https://ift.tt/nFLpaGW
via IFTTT

Tracking TamperedChef Clusters via Certificate and Code Reuse

Executive Summary

This article documents novel activity clusters that have significant overlap with the publicly described threat known as TamperedChef (aka EvilAI). TamperedChef-style malware is trojanized productivity software, such as PDF editors or calendars, that deliver malicious payloads.

These campaigns typically employ malicious ads that direct users to sites hosting the applications. While this style of malware shares many similarities in technical operation, installation lures and distribution methods, we do not attribute it to a single author or group.

TamperedChef-style malware samples share characteristics with potentially unwanted programs (PUPs) and adware. These include robust mechanisms to remain persistent, and end-user licensing agreements (EULAs) that attempt to legally cover the software's questionable actions. However, TamperedChef-style malware is far more stealthy than PUPs or adware, remaining dormant for weeks to months before activating. This includes continuous command and control (C2) methods enabling adversaries to retrieve additional payloads, such as information stealers, proxy tooling or remote access Trojans (RATs).

We have been tracking several campaigns of TamperedChef-style activity starting in 2024, with three distinct clusters: CL-CRI-1089, CL-UNK-1090 and CL-UNK-1110. Between the three clusters of activity, we have identified over 4,000 samples across 100 unique variants.

Palo Alto Networks customers are better protected from TamperedChef activity discussed in this article through the following products and services:

• Cortex XDR and XSIAM
• Prisma Browser

If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.

Related Unit 42 Topics

AI, Malware, Adware, RATs, Malvertising

The Rise of Malicious Productivity Applications

Since early 2024, we have observed a sharp increase in information stealer-style incidents originating from software mimicking legitimate productivity tools (e.g., PDF editors, ZIP file extractors, GIF image makers). Upon deeper inspection, these applications generally contain code that enables the delivery of arbitrary binaries. These features are typically used to deploy stealer malware.

In 2025, our telemetry revealed over 100 unique variants of malware masquerading as productivity software. They all contained a malicious component, such as basic RAT capabilities, or delivering adware and infostealers.

Due to their legitimate functionality and tendency to remain dormant for long periods of time, these applications often go unnoticed by the victim. They are also commonly downplayed or miscategorized by defenders and security researchers as potentially unwanted programs (PUPs). Because these applications can execute arbitrary code on victims' machines, either directly or indirectly through module loads, these threats are more significant than mere background annoyances or adware.

We have been able to track over 4,000 file hashes and 81 unique code signing organisations through several methods, including:

• Reviewing code-signing certificates of the binaries
• Analyzing code reuse among the binaries
• Open-source intelligence (OSINT) on corporate structures for organizations distributing the binaries
• Leveraging ad transparency platforms to hunt for advertising overlaps that can identify additional organizations distributing the binaries

We have identified TamperedChef-style malware campaigns starting in 2023. These malicious productivity application campaigns include AppSuite PDF, Calendaromatic, JustAskJacky and CrystalPDF.

Masquerading in Plain Sight

The actors behind these campaigns take steps not commonly observed with other adware groups to remain undetected. In some cases, these attackers appear to diversify their revenue streams through more aggressive and malicious activities. This diversification includes deploying infostealers, establishing residential proxies and exhibiting behavior that resembles access brokers.

These applications avoid many of the common indicators that users are trained to associate with downloading malicious software, such as:

• Distributing via well-built, legitimate-looking websites
  • Without ads (as shown in Figure 1)
  • Appearing modern and credible
  • Containing common elements like descriptions, legal terms and contact pages
• Leveraging unique and contextually relevant domains for each campaign
• One-click download buttons distributed by large content distribution networks (CDNs) to minimize friction
• Providing promised functionality with minimal bloat, meaning victims are not likely to suspect anything is amiss

Figure 1. Examples of download pages for TamperedChef-style fake productivity applications.

Attackers also employ several tricks to avoid detection. These tricks include:

• Using code signing to increase the apparent legitimacy of the binaries
• Rebuilding binaries with only minor changes on a frequent basis to minimize the effectiveness of static or hash-based detection
  • The exact frequency varies, but is typically between one week and one month per rebuild
• Remaining dormant for periods of weeks to months before retrieving or running malicious components

This combination of technical and social masquerading enables these applications to remain undiscovered, unreported and free to operate without resistance for months — if not years — at a time.

What Is Adware vs. Malware?

Adware is a class of software designed to increase the number of ads a user observes. The more ads they observe, the more money for the distributor. This is typically done with some form of browser manipulation or additional free tooling bundled alongside downloads.

Adware sits in a middle zone between malware and legitimate software, often employing malware-like tactics to maintain persistence or display more ads to users. The distinction between malware and adware can be so fine that they are indistinguishable from each other when statically analyzed, only becoming clear after misuse occurs. Adware and malware are also often interlinked, with many seemingly legitimate adware developers overstepping into malware territory, either naively or intentionally.

Modern adware also walks the line between legal and illegal behavior. EULAs are ways that the groups behind adware and TamperedChef-style malware attempt to protect themselves legally. Examples of this are found on websites distributing TamperedChef-style software, such as one from hxxps[:]//www.crystalpdf[.]com/conditions:

“The Additional Services offer users enhanced, tailored features. Be aware that using these services may modify your browser’s new tab settings or installed features, possibly altering your browser configuration.”

However, TamperedChef-style programs execute commands remotely, exfiltrate users' credentials and deploy malware without consent. These actions firmly place them in the malware category.

A Historical Review of TamperedChef (Aka EvilAI)

The name TamperedChef was initially given to a cluster of activity that included several malicious recipe applications, PDF editors, manuals and search assistant applications. It started to see widespread installation in June 2025, with some evidence suggesting these applications have been in the wild since February 2025.

As reporting on malicious productivity apps within the cybersecurity community grew, TamperedChef became a broad, informal term for several productivity software campaigns. These campaigns are likely not all operated by the same group.

The confusion in previous reporting is understandable, as many of the actors are leveraging extremely similar tactics, techniques and procedures (TTPs) and lures. The differences only become apparent when observing the infrastructure, code quality and organizations tied to the code signing. It is important to understand these differences to separate the attackers' motivations, capability and risks.

We identified and tracked three major clusters of activity that share many of the same operational traits, but we believe these represent three distinct groups. We track the three main activity clusters as CL-CRI-1089, CL-UNK-1090 and CL-UNK-1110.

The CL-UNK-1110 cluster is most commonly associated with the TamperedChef alias and includes campaigns distributing applications such as:

• JustAskJacky
• GoCookMate
• RocketPDFPro
• ManualReaderPro

Acronis has researched and reported on this cluster in detail. While this cluster remains active and significant, the primary focus of our analysis will be on the two other clusters, CL-CRI-1089 and CL-UNK-1090.

The CL-CRI-1089 cluster has been identified as active since early 2023. It includes several high-profile campaigns distributing applications such as:

• Calendaromatic
• DocuFlex
• AppSuite PDF

These campaigns leverage a diverse set of deployment methods and show the most change when it comes to the malware’s techniques and tactics. This group leveraged infrastructure and code-signing certificates related to Ukrainian, Malaysian and British entities, which has remained consistent over the last two years of operation.

CL-UNK-1090 is unique in its clear evidence of vertical integration between marketing and malware creation. Similar to other clusters, the group behind this cluster distributes its malware via malicious advertisements (aka malvertisements).

A review of public records on corporate structures shows that, unlike the other groups, CL-UNK-1090 operators own both the code-signing companies and the ad agencies distributing the malware. This cluster used primarily Israeli infrastructure and code signing entities. It is responsible for several recent campaigns, including:

• CrystalPDF
• Easy2Convert
• PDF-Ezy

Victimology

We have observed approximately 12,000 unique instances of this fake productivity software across our customer base. Our analysis shows that this threat is global with no significant geographic or sector targeting within the Managed Threat Hunting customer base.

The data highlights that while Israel and the U.S. see slightly higher targeting than other countries, TamperedChef-style malware is seen globally in non-negligible volumes.

This is consistent across all three clusters, indicating that they all appear to operate globally.

Tracking TamperedChef-Style Samples

Understanding the capability of these threats is crucial to detection, response and disruption. Fortunately, the malware operators have made several design decisions that we can leverage to identify and link large portions of their operations.

Tracking via Code-Signing Certificates, Code Reuse and Infrastructure Overlaps

One unique attribute of the TamperedChef-style malware is that almost all the first-stage binaries are signed with legitimate code-signing certificates. Attackers used code-signing to add stealth to these payloads. However, a lack of proper certificate hygiene allowed us to follow these samples further than any one campaign.

We initially identified code signing reuse with the Calendaromatic campaign. This campaign involved a simple Neutralinojs framework-based calendar app, contained in a 7z self-extracting archive (SFX). The calendar app would operate as expected, but it also contained a relatively basic RAT that enabled attackers to collect and install a second-stage payload.

This campaign gained some attention due to its novel use of homoglyphs to obfuscate the incoming command strings. The 7zSFX when extracted contains both a calendaromatic-win_x64.exe binary that is essentially just a wrapper for the real bulk of the code, a heavily obfuscated Neutralinojs resource file named resources.neu.

Public reporting highlighted that the 7zSFX file was signed by CROWN SKY LLC. Digging further through malware repositories, we identified four total files with the same core behavior of a 7zSFX file containing a calendaromatic-win_x64.exe binary and a resources.neu file. The resources.neu file varied across the samples. However, all appeared to contain similar functionality with differing C2 locations.

Of these four samples identified, we identified two unique signers. Samples one and two were signed by CROWN SKY LLC and sample three was signed by MARKET FUSION INNOVATIONS LLC. The final sample was found to not be signed and may not have been deployed widely.

Code-signing certificates are considered private material and not commonly shared between entities. A single code base signed by two uniquely authored certificates generally indicates that a single entity or actor is in possession of both code-signing certificates. This can occur for several reasons, including certificate theft, a single entity with ownership of two or more organisations (e.g., shell corporations) or organisations providing code signing as a service.

Reviewing sample repositories for evidence of this new signer, we found two additional campaigns that we identified as related to the Calendaromatic operators: PDFPrime and ManualzPDF. Both PDFPrime and ManualzPDF campaigns share striking similarities and likely share a codebase.

Similarities between the samples include:

• The same C2 domain structures
• Shared code signing dates
• Shared embedded PDF editors

However, these samples are very distinct from the Calendaromatic campaign, sharing no code. This highlights attackers’ preference to abandon codebases upon discovery rather than iterate and evolve. Figure 2 below shows a simplified view of these certificate chains.

Figure 2. Simplified signature flow of reuse between samples.

The PDFPrime and ManualzPDF campaigns have several distinct variants, all with different code signers. Due to the high degree of code overlap, we clustered 34 samples to the PDFPrime/ManualzPDF codebase. We call these samples PixelCheck due to the C2 domains leveraging the format of pixel.toolname[.]com. They represent some of the earliest evidence of the Calendaromatic operator’s activity originating in late 2023.

Pivoting through sample repositories to identify other examples of the PixelCheck variant, seven additional signers were identified in the code of related malware:

• ADVANTAGE WEB MARKETING LLC
• Europae-Solutio Ltd
• SP Development and Solution Limited
• BUZZ BOOST ADVERTISERS LLC
• ADSMARKETO LLC
• LLC MATCH-TWO-USERS
• Monetize forward LLC

Tracking these samples via code signing overlaps involves:

• Identifying the code signers
• Mapping their certificate chains
• Pivoting to similar samples
• Repeating the steps with newly identified signers

This iterative approach uncovered an extensive network of seemingly disparate samples, all linked to a single group through certificate ownership.

While effective, this discovery method relies on lax operational security. True certificate isolation would prevent expanded identification and limit certificate burning.

Reusing code signing across variants also does not appear to be a cost-saving measure, as multiple campaigns often use unique signers rather than reusing a small set of certificates. If cost minimization was the primary goal, we would not see these cases of individual certificate use.

Certificate reuse most commonly appears to be a result of poor testing practice, where attackers use previous certificates on early samples of a new campaign before they can procure a dedicated certificate.

At the current cost of code-signing certificates, burning more than two certificates per campaign carries heavy financial costs. As a result of this research, we attributed a total of 34 unique code-signing certificates related to the Calendaromatic campaign to the CL-CRI-1089 cluster.

Based on the current cost of code-signing certificates, this inefficient approach likely cost the operators over $10,000 in certificate expenses alone. This further highlights the scale of this operation, where this sum is likely considered a reasonable operational cost.

Tracking via Advertising

Much of the TamperedChef-style malware distribution is via ads, and as such it is subject to ad transparency. Ad transparency is a byproduct of regulation requiring players in the distribution of advertising to provide insights into ad content and owners. Many of the major platforms in the space have their own version of an ad transparency tool or dataset, and investigators can use these to map and track malvertising campaigns.

In most cases, ad transparency platforms enable searching either by the advertiser or the site being advertised. While the definition of an advertiser can be complicated, for the most part, the advertiser is the entity that sold or is selling an ad within the platform.

This means there is no guarantee that the malware operator and the ad seller are the same or related entities. However, it implies that the malware operator has interacted with the advertiser in some capacity (e.g., exchanging funds or ad details). Advertisers using these advertising marketplaces are held to certain standards by the platforms and must abide by the terms of service, which distribution of malware would typically breach.

TamperedChef-style campaigns are different from many other malvertising campaigns, as the malware creators and advertisers are generally vertically integrated. This vertical integration means advertisers also create the malware and, on occasion, sign the code. This direct link between code signers and advertisers implies a strong relationship between malware operators and distributors. This link can provide a starting point to map the wider network distributing this malware.

This is particularly evident with activity in CL-UNK-1090 being run by attackers that are clearly well versed in using ad marketplaces to distribute their malware. For CL-UNK-1090, we identified more than 20,000 unique ads deployed over several years via ad transparency platforms. This volume of ads is unlikely to originate from an individual. The OneZip campaign belonging to the CL-UNK-1090 cluster provides a real-world illustration of how tracking these clusters through advertising commonality and agencies works.

OneZip is a malicious compression tool with binaries signed by TAU CENTAURI LTD observed in the wild in early 2025. OneZip was distributed via the site onezipapp[.]com (Figure 3 shows the landing page).

Figure 3. OneZip landing page.

By leveraging ad transparency platforms, we find that a single advertiser (CANDY TECH LTD) creates and distributes ads for onezipapp[.]com. Based on information from these platforms, CANDY TECH LTD has distributed approximately 4,000 ads that appear related to malicious productivity applications starting in June 2024.

Figure 4 below shows an example of the ads distributed. While not the most innovative, attackers have taken care with these ads to consider language, format, logo and branding. This indicates an actor well-versed in the AdTech space.

Figure 4. Example OneZip ads run by CANDY TECH LTD.

Between June 2024 and December 2024, ad transparency platforms report that CANDY TECH LTD pushed ads for JustConvertFiles, a similar TamperedChef-style campaign. JustConvertFiles is a malicious file conversion tool similar in operation to all other TamperedChef-style samples.

JustConvertFiles binaries are signed by B.L.A ASPIRE LTD and PASTEL CONCEPTION LTD, and entities with these names are both observed reusing certificates. These entities appear to be responsible for several other campaigns, including:

• PDFPilot
• SwiftNav
• ShinyPDF
• FileEase

Based on advertising transparency data, we have not observed CANDY TECH LTD representing any campaigns other than TamperedChef-style malware.

CANDY TECH LTD is also observed in the malware creation stages, too. Several TamperedChef-style binaries are signed by CANDY TECH LTD or have other links to an entity with this name. These include:

• ZipMakerPro
• GifsMakerPro
• ScreensRecorder
• RapiDoc (contained a copyright stub with CANDY TECH LTD, but not signed)

We then performed the following activities to substantially flesh out CL-UNK-1090 and CL-CRI-1089, and to identify additional campaigns:

• Leveraging known TamperedChef download URLs
• Identifying the advertiser
• Pivoting around the public information on these advertisers

These advertising pivots are not without limitations, and many malvertising actors do not have the expertise to set up the AdTech infrastructure, instead relying on established entities for distribution. This makes any sensible linking through public sources much more difficult, as most of the time, the malware advertising only accounts for a small percentage of the advertisers' overall ad presence. In these cases, other methods are likely to be more effective. However, when possible, investigating the distributor can provide more information.

Tracking via Co-location and Corporate Structures

The TamperedChef-style malware footprint is large and well-organised, with hundreds of campaigns and large sums of money invested. All TamperedChef certificates are validated by an organization, which means certificate authorities require a corporate entity to fulfill OV/EV requirements to be granted certificates.

Certificate issuers impose these validation requirements to aid in maintaining the reputation of signed code. There is a cost, of both money and time, for adversaries to establish a corporation for the sole purpose of signing code.

Corporate structures tend to leave traces, particularly in countries where data is publicly available. This opens new avenues for discovery.

OSINT sources such as private and government-run corporate search engines can be used to gain rapid insights into corporate entities. Our primary focus areas when tracking code-signing entities were:

• Co-location, especially in residential dwellings
• Companies with a handful of employees and minimal presence, especially when owned by much larger corporations, can indicate possible shell corporations
• Shared ownership structures, particularly when shared ownership is by an individual and not a corporate entity
• History of company renames (especially renames that are potentially aligned with malware campaigns)

With the CL-UNK-1090 cluster, we can use CANDY TECH LTD as an example again. Ad transparency data indicates that CANDY TECH LTD is registered in Israel. Leveraging Israeli company search engines, we found CANDY TECH LTD with a listed phone number, website, address and ownership structure.

Figure 5 below shows the webpage for CANDY TECH LTD.

Figure 5. CANDY TECH LTD webpage.

From public records, Zizik with me is the director of CANDY TECH LTD and Fairark Systems Ltd. consists of option holders for the company.

Zizik with me and Fairark Systems Ltd. are listed as having sole ownership stakes in several companies in Israel, such as:

• AMARYLLIS SIGNAL LTD
• TAU CENTAURI LTD
• RED ROOT LTD
• BITTERN SKY LTD
• TOGO NETWORKS LTD

The list of companies that we mined from the Zizik with me and Fairark Systems Ltd. ownership structures — as well as some minor variations and co-location checks — match the names of companies that signed significant volumes of TamperedChef-style code. With high confidence, we believe these ownership structures link all cases to a single group.

Additionally, many of these companies have undergone several name changes in the past three years. Many of the old names match names that were used to sign TamperedChef-style malware.

Fairark Systems Ltd. is the registered name of FireArc, an Israeli advertising company. It states it creates games, connected TV applications, eCommerce solutions and, notably, utility applications. Figure 6 shows this statement on its website.

Figure 6. FireArc marketing pages stating they create utility applications.

Additionally, the RapiDoc campaign created by CANDY TECH LTD has a program database (PDB) (D:\!Work\Clients\<user>\Projects\RapiDoc\SrcForTests\RapiDoc\x64\Release\RapiDoc\RapiDoc.pdb). This could have been left by mistake in the RapiDoc binaries installed during execution.

PDBs are created during the build process for binaries and contain useful symbol and debug information. Binaries that are productionized tend to remove the PDB, as it can provide reverse engineers a head start when analyzing a binary, which is not desirable for either legitimate software or malware. PDBs, where applicable, were for the most part removed from other TamperedChef-style samples, indicating that this was likely an error.

The SHA256 hashes for the binaries containing the PDB are:

• 248de1470771904462c91f146074e49b3d7416844ec143ade53f4ac0487fdb44
• 2231bfa7c7bd4a8ff12568074f83de8e4ec95c226230cccc6616a1a4416de268

The Wide-Reaching Web of TamperedChef

Leveraging several linking methods, we broadly identified significant portions of these activity clusters’ operations, mapping several networks of TamperedChef-style malware. While this may not represent their entire infrastructure, it highlights the pervasive nature of this threat. We supply all identified samples, domains, signers and any other relevant details in the Indicators of Compromise section.

CL-CRI-1089

Using Calendaromatic as a starting point, we mapped out the CL-CRI-1089 cluster to include 34 unique code-signing entities. Our primary method of identification was code and certificate reuse. We observed some evidence of shared corporate addresses with code signers. However, generally, each entity was separately created and operated.

The CL-CRI-1089 cluster included malvertisements generated through self-created and likely dedicated companies. This cluster did not appear to cross-contaminate advertising entities with code-signing entities. This cluster primarily leveraged companies based out of Ukraine, Malaysia, Singapore, the U.S. and the UK to perform operations. In cases where the owner's place of birth was recorded by the UK government, all owners were of Ukrainian origin.

We identified over 3,300 samples related to CL-CRI-1089 across Palo Alto Networks and public sample databases, with the vast majority related to productivity software.

CL-UNK-1090

We mapped out CL-UNK-1090 primarily through a combination of real-world incidents, OSINT on the FireArc corporate structures and advertising network links. Certificate and code reuse were present but formed less of a basis for discovery.

We found CL-UNK-1090 used 39 Israeli corporations for certificate generation. This cluster included changed organization names to mine these structures for multiple certificates, so the real number of organizations is likely less than 39. We identified approximately 750 samples related to CL-UNK-1090, all with productivity application themes.

Malvertising as a Service: How Did the Threat Scale?

The scale of TamperedChef-style malware is immense. We found evidence of the two tracked clusters (CL-CRI-1089 and CL-UNK-1090) across more than 50% of Managed Threat Hunting customers. If this number is an accurate representation of the wider community, it shows an operation on a scale rarely observed.

The distribution and scale of these campaigns come with high monetary and labor costs. TamperedChef-style actors are likely to have bought much of their success. They have positioned themselves less as malware experts than as advertising and logistics specialists.

Buying Legitimacy: Purchasing Code-Signing Certificates

Code signing as a practice provides authenticity and integrity validation to binaries, but it can be misused by malicious actors. Purchasing code-signing certificates offers a marginal increase in binary trustworthiness. However, they come with strict identity validation and cost, which can deter many malware developers.

These requirements did not impede any of the TamperedChef actors, and one of their key strengths comes from a deep understanding of the business side of advertising. The development of several shell companies appeared minimally impactful and provided a reusable pool of code-signing certificates. In the case of CL-UNK-1090, it appeared that renaming existing companies was enough to be granted new, valid certificates, further lowering the barrier for entry.

In recent months, we’ve identified a trend of these clusters moving away from code signing. This shift could be occurring because these binaries are becoming better understood and researched. The damage done by identifying an entire campaign through tracking code signers may now outweigh the benefits gained through signing binaries.

Buying Speed: The Influence of Distributed Development and AI

The rate and scale at which the TamperedChef-style actors deploy new campaigns is incredibly fast. Attackers run tens of campaigns simultaneously, with new ones being developed constantly.

The CL-CRI-1089 cluster, in particular, demonstrates a high degree of variation. Each campaign features an entirely new set of TTPs, delivery methods, languages, functionality and C2 structures. This suggests a new codebase for each campaign, and potentially even different developers.

The code quality also shows a lack of mature development practices and teams likely inexperienced with malware development. This does somewhat work in favor of TamperedChef binaries, as upon first glance, the C2 methods are not always obvious.

In the case of CL-CRI-1089, the codebases are highly variant. However, they share common certificates, demonstrating limited code reuse between campaigns. This may indicate they were created by several development teams or that generative AI was at least partially responsible for the set of campaigns.

Distribution infrastructure setup appears to be largely driven using generative AI. This is particularly evident with the distribution websites where the content of pages for different campaigns appears visually similar. However, they have distinct Document Object Model (DOM) structures. This is indicative of a non-deterministic development practice, which is characteristic of content generated by large language models (LLMs).

Buying Visibility: Hijacking the Advertising Pipeline and Search Engine Optimization (SEO)

TamperedChef-style samples for all clusters are distributed primarily through malvertisements, sponsored results and search engine marketing techniques. Our telemetry for real-world infection chains commonly shows victims browsing terms like “free calendar prints” or “document formatting” before being served the malvertisements.

TamperedChef-style malware establishes a distribution-first approach. Getting installed by the masses is far more important to the operators than managing persistent and reliable C2.

Technical Analysis of TamperedChef Malware Samples

Operational Commonalities Across All Samples

While none of the identified TamperedChef malware samples are technically complex, they vary significantly between campaigns. All samples tend to share a common set of TTPs and second-stage payloads, which only serves to further highlight the motivations and risks these TamperedChef-style malware samples pose.

These universal TTPs include:

• Leveraging code signing for the first-stage payloads
• Implementing a robust persistence mechanism, almost always through scheduled tasks or registry Run keys
• Initial information gathering and exfiltration typically occurring on install
  • This usually involves simple data collection, like system version, hostname and active browsers.
  • However, we have seen more targeted information gathered, including patch levels, user details, domain information, geolocation and screen size.
• Employing a delayed activation technique to evade detection
  • Initially, the samples mimic legitimate applications, remaining dormant for days or even weeks.
  • Upon activation, they trigger the next stage, which typically involves downloading and executing an additional payload delivered via an upstream API.
• Obfuscating the malicious components
  • This is the clearest evidence to suggest that these binaries are not just simple adware.
  • Most of the campaigns we observed used some form of obfuscation or defense evasion techniques for their loader or stealer components.
  • While obfuscation is used for intellectual property (IP) protection, in this case, the routines were primarily for de-obfuscating incoming payloads within the loader components.
  • Since no other parts of the binaries were obfuscated, IP protection was likely not the main reason for these methods.

Delivering Second Stage Malware

TamperedChef-style malware, when activated, can deliver arbitrary payloads, but in practice sticks to two primary categories: adware and browser hijackers or RATs and stealer malware. Which payload it delivers depends on the campaign specifics. TamperedChef rarely deploys both simultaneously.

Adware and Browser Hijacking

The primary objective of the majority of the TamperedChef-style binaries is to distribute ads or gain some form of control over the user’s browser. This has been achieved via either:

• Installing a new adversary-controlled default search engine in the user’s primary browser
• Installing an entirely new adversary-controlled browser (e.g., OneBrowser)

Both these methods enable adversaries to control the content searched, ads displayed to victims and, in the case of the browser installation, full control over user cookies and credentials.

Stealers and RATs

While adware can be disruptive and undesirable, it does not generally pose a major organizational risk. TamperedChef-style binaries, on the other hand, display a level of stealth, defense evasion and persistence that is unusual and excessive for adware.

This likely further indicates that the true threat of the TamperedChef-style malware goes beyond adware and into more insidious use cases. This is backed by real-world cases where attackers have consistently deployed active C2 and stealer-style malware as second stages targeting victims’ browser credentials or for information gathering.

These second-stage stealers range in capability, targets and formats but are almost always deployed after a dormancy period of weeks. Evidence of more exotic payloads has been observed too, but far less frequently and not en masse. An example of this was the AppSuite campaign that saw the sporadic installation of proxy-style malware.

Distilling the Motivations

Our analysis shows that CL-CRI-1089 activity focuses on criminal-style activity targeting credentials, deploying adware and in some cases proxy-style payloads. Based on sample and corporate analysis, the operators of CL-CRI-1089 are globally distributed but centrally operated.

In contrast, the motivations behind CL-UNK-1090 activity are far less clear. This activity appears to be solely managed by a much smaller group of entities related, at least in part, to a seemingly successful advertising agency.

These samples are all designed to look like adware. However, the samples do not operate like adware, housing RATs with .NET loader-style capabilities that legitimate adware or productivity software do not require.

In real world cases, we have not observed the same volume of malicious second stage deployments from samples tracked as CL-UNK-1090 as we have with the CL-CRI-1089 samples. However, second stages deployed by CL-UNK-1090 are more stealthy, existing primarily in memory and include RAT deployments, browser hijackers and adware.

Detection, Prevention and Response to Future Threats

Preventive Recommendations

Some key preventive steps to combat this threat are:

• Education: Ensure users are aware of this style of threat and know that even legitimate looking software can carry risks
• Endpoint/extended detection and response (EDR/XDR): Ensure updated EDRs/XDRs are in place on all hosts within an environment
• Enterprise browsers: Enterprise browsers can help protect against this threat and ensure that in the event of compromise, saved credentials remain secure
• Device hardening: Consider hardening user endpoints to prevent the installation of software from untrusted sources

Detection and Response

Due to the prevalence of these threats, continuous active monitoring and hunting can have a very high return on investments however due to the varied nature of these threats hunting queries vary in effectiveness.

If these threats are identified, our general remediation advice is to:

• Remove and/or quarantine all files associated with the malicious software
  • These are generally located in the installation folder
• Ensure that persistence mechanisms such as the created scheduled tasks are removed to prevent reinfection
  • Consider running a full malware scan of the host as it may identify any second-stage components
• Consider revoking active tokens for the impacted users and resetting their credentials
  • It is likely that any browser-based credentials are potentially compromised
• Review access logs to ensure that the impacted users' credentials are not actively being misused

Conclusion

TamperedChef-style campaigns are likely to continue to misuse advertising pipelines to deliver malware, developing and adapting new lures and evasion methods. The prevalence of the CL-CRI-1089, CL-UNK-1090 and CL-UNK-1100 clusters will likely serve as a blueprint for future malvertising campaigns.

New trends, such as moving away from using code signing, will require new tracking methods to be developed to remain ahead of these actors' operations.

Palo Alto Networks Protection and Mitigation

Palo Alto Networks customers are better protected from the threats discussed above through the following products:

Cortex XDR and XSIAM help to prevent the threats described in this blog, by employing the Malware Prevention Engine. This approach combines several layers of protection, including Advanced WildFire, Behavioral Threat Protection and the Local Analysis module, designed to prevent both known and unknown malware from causing harm to endpoints.

Prisma Browser helps to prevent access to known malicious campaigns using Advanced URL Filtering, Advanced Web Protection (Live Page Scanning) which runs AI models within the browser to detect attack patterns, file download scanning and protection on the default search engine.

If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:

• North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
• UK: +44.20.3743.3660
• Europe and Middle East: +31.20.299.3130
• Asia: +65.6983.8730
• Japan: +81.50.1790.0200
• Australia: +61.2.4062.7950
• India: 000 800 050 45107

Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.

Indicators of Compromise

Table 1 lists the signers’ organization noted in code-signing certificates used in the TamperedChef-Style malware samples we found in our research.

Signer	Related Cluster
CANDY TECH LTD	CL-UNK-1090
G.R.CIGAR. LTD	CL-UNK-1090
TAU CENTAURI LTD	CL-UNK-1090
AMARYLLIS SIGNAL LTD	CL-UNK-1090
METROPOLITAN DESIGN LLC	CL-UNK-1090
BLACK INDIGO LTD	CL-UNK-1090
Red Root LTD	CL-UNK-1090
A1A Marketing Ltd.	CL-UNK-1090
GOLD HARMONY LTD	CL-UNK-1090
BEGONIA LIFE LTD	CL-UNK-1090
SAMBUSAK LLC	CL-UNK-1090
ACTIVE INTELLECT AI LLC	CL-UNK-1090
VAST LAKE LTD	CL-UNK-1090
LONG SOUND LTD	CL-UNK-1090
B.L.A ASPIRE LTD	CL-UNK-1090
VANILLA FORCE LTD	CL-UNK-1090
SELA LINES LTD	CL-UNK-1090
WIND TRUST LTD	CL-UNK-1090
BLUE TAKIN LTD	CL-UNK-1090
ORCHID MARS LTD	CL-UNK-1090
ENIGMATIC SAOLA LTD	CL-UNK-1090
TROPICAL RIFF LTD	CL-UNK-1090
BITTERN SKY LTD	CL-UNK-1090
astro bright ltd	CL-UNK-1090
my tech media ltd	CL-UNK-1090
LIGHTNER TOK LTD	CL-UNK-1090
TOGO NETWORKS LTD	CL-UNK-1090
CHRONO ORION LTD	CL-UNK-1090
LOGOS AQUA LTD	CL-UNK-1090
Impresan Solutions OÜ	CL-UNK-1090
Shopcut LLC	CL-UNK-1090
Judy Wanjiru	CL-UNK-1090
Keen Internet Technologies Ltd	CL-UNK-1090
ROYAL STEP LTD	CL-UNK-1090
Smart Contract LLC	CL-UNK-1090
DORNOVI LTD	CL-UNK-1090
Green Topaz Ltd	CL-UNK-1090
LOGOS AQUA LTD	CL-UNK-1090
SPARROW TIDE LTD	CL-UNK-1090
mania tech ltd	CL-UNK-1090
PASTEL CONCEPTION LTD	CL-UNK-1090
Mainstay Crypto LLC	OneBrowser Signers
Crowd Sync LLC	OneBrowser Signers
WORK PRODUCT, INC.	OneBrowser Signers
Chickadee Digital	OneBrowser Signers
Riya Software	OneBrowser Signers
Eman Group, LLC	OneBrowser Signers
MATCH-TWO-USERS LLC	CL-CRI-1089
TWEAKSCODE LLC	CL-CRI-1089
AFFILIDADOS	CL-CRI-1089
MARKET FUSION INNOVATIONS LLC	CL-CRI-1089
BUZZ BOOST ADVERTISERS LLC	CL-CRI-1089
ADSMARKETO LLC	CL-CRI-1089
CROWN SKY LLC	CL-CRI-1089
Summit Nexus Holdings LLC	CL-CRI-1089
Europae-Solutio Ltd	CL-CRI-1089
SP Development and Solution Limited	CL-CRI-1089
Echo Infini SDN BHD	CL-CRI-1089
COMMERCE GROUP TECHNOLOGY LTD	CL-CRI-1089
ALGORYTHM TECH LTD	CL-CRI-1089
Byte Media Sdn Bhd	CL-CRI-1089
GLINT SOFTWARE SDN. BHD	CL-CRI-1089
Global Tech Allies ltd	CL-CRI-1089
SOFT SOLUTIONS HUB	CL-CRI-1089
Monetize forward LLC	CL-CRI-1089
ADVANTAGE WEB MARKETING LLC	CL-CRI-1089
Incredimarket	CL-CRI-1089
ILLUSION MEDIA SOLUTIONS	CL-CRI-1089
Virtual Media App Ltd	CL-CRI-1089
DEV SPOTS LLC	CL-CRI-1089
Digit Consult	CL-CRI-1089
Outsource Genius LLC	CL-CRI-1089
OneStart Technologies LLC	CL-CRI-1089
Apollo Technologies Inc	CL-CRI-1089
Caerus Media LLC	CL-CRI-1089
Digital Promotions Sdn. Bhd.	CL-CRI-1089
Eclipse Media Inc.	CL-CRI-1089
Astral Media Inc	CL-CRI-1089
Incredible Media Inc	CL-CRI-1089
STYLE SOLUTION LIMITED	CL-CRI-1089

Table 1. Signers of code-signing certificates from the TamperedChef-style malware samples.

Additional Resources

• Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads – Acronis
• When the Dash Hits the Fan: Artificial Intelligence Exposes the Homoglyph Hustle – GuidePoint Security
• EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks – TrendMicro
• Malicious Appsuite PDF Editor Spreads Tamperedchef Malware – Truesec
• The history of AppSuite: the certs of the BaoLoader developer – Expel

from Unit 42 https://ift.tt/rzcqYsE
via IFTTT