We are not attributing this to a nation-state actor at this time. The actor’s activity is limited to the gaming sector, specifically in China, and does not appear to target enterprise environments. The company also suspended the account that submitted Netfilter and reviewed previous submissions for signs of additional malware. The company has since added Netfilter detections to the Windows Defender AV engine built into Windows and provided the detections to other AV providers. The post said that Microsoft has found no evidence that either its signing certificate for the Windows Hardware Compatibility Program or its WHCP signing infrastructure had been compromised.

We have suspended the account and reviewed their submissions for additional signs of malware.” The actor submitted drivers for certification through the Windows Hardware Compatibility Program. In a brief post from Friday, Microsoft wrote, “Microsoft is investigating a malicious actor distributing malicious drivers within gaming environments. Microsoft’s digital signature, along with the root certificate the malware installed, gave the malware stealth and the ability to send decrypted TLS traffic to hxxp://110.42.4.180:2081/s. “In addition to the IP redirecting component, it also installs (and protects) a root certificate to the registry.” “The core functionality seems to be eavesdropping on SSL connections,” reverse engineer Johann Aydinbas wrote on Twitter. He and fellow researchers decided to figure out precisely what the malware does. He initially thought the detection was a false positive because Microsoft had digitally signed Netfilter under the company’s Windows Hardware Compatibility Program.Īfter further testing, Hahn determined that the detection wasn’t a false positive. Eavesdropping on SSL connectionsĮarlier this month, Karsten Hahn, a researcher at security firm G Data, found that his company’s malware detection system flagged a driver named Netfilter. Without a Microsoft certificate, these types of programs can’t be installed by default.

For the past 13 years, Microsoft has required third-party drivers and other code that runs in the Windows kernel to be tested and digitally signed by the OS maker to ensure stability and security. The blunder allowed the malware to be installed on Windows machines without users receiving a security warning or needing to take additional steps. Microsoft gave its digital imprimatur to a rootkit that decrypted encrypted communications and sent them to attacker-controlled servers, the company and outside researchers said.

Microsoft windows malicious