Digitally signed applications and credible sites used to deploy JavaScript backdoors hidden by advanced obfuscation techniques
Acronis, global leader in the cybersecurity and in the data protection, announces that the Acronis Threat Research Unit (TRU) has identified a sophisticated global malvertising and SEO poisoning campaign called TamperedChef, responsible for the distribution of apparently legitimate, digitally signed applications with real functionality, used as a vector for the execution of JavaScript backdoors containing hidden code via obfuscation techniques. The level of credibility of the applications, combined with the use of valid certificates and download sites designed to appear trustworthy, makes the operation particularly effective in bypassing traditional controls and deceiving less experienced users.
The investigation conducted by TRU highlighted an extremely structured infrastructure, which follows industrial logic and a "business" operating model. The campaign's operators rely on a network of shell companies registered in the United States to obtain new digital signature certificates and replace them as soon as they are revoked, thus maintaining operational continuity and an image of legitimacy. The applications are signed via Extended Validation certificates and have authentic functionality, which helps make the software perceived as genuine, further reducing user suspicions.
According to Acronis telemetry, the impact of the campaign is mainly concentrated in the Americas, with a significant spread in the United States. The victims belong to heterogeneous sectors, with a particular incidence in the healthcare, manufacturing and construction sectors. These are areas often characterized by the need to quickly find manuals, technical documents or support tools, activities that TamperedChef operators have chosen to exploit through malicious advertisements and sites optimized to appear among the first search engine results.
During the analysis, numerous compromised applications were identified, including All Manuals Reader, Manual Reader Pro, Any Product Manual, as well as various seemingly harmless games and tools. All installers follow the same pattern: they present plausible license windows, installation confirmations, and, at the end of the process, open a thank you page to simulate behavior identical to that of legitimate software. At the same time, the installer deposits an XML file which is used to generate a scheduled activity: it is through it that the attack maintains its persistence on the system. This allows the JavaScript payload to run periodically, with random delays, making it more difficult to spot anomalous behavior in the early stages of the infection.
The JavaScript payload presents hidden code through obfuscation techniques, similar to those seen in recent campaigns leveraging desktop application frameworks or scripting environments. Once active, the backdoor collects system information, interacts with the Windows registry to generate a unique identifier, executes remote commands, and communicates with the Command and Control (C&C) server via HTTPS requests. Over time, operators have also evolved the infrastructure of their C&C servers, moving from domains with pseudo-random strings similar to those typical of DGA algorithms to more recognizable names, designed to better integrate into ordinary network traffic.
The purposes of the operation are multiple. The backdoor allows you to grant initial access that can be resold to other criminal groups, allows the theft of credentials and sensitive information – particularly profitable in the healthcare sector – and offers the possibility of preparing future large-scale ransomware operations. Furthermore, it cannot be ruled out that the group may choose to exploit particularly sensitive access in an opportunistic manner, with the aim of gathering information or supporting the activities of more structured groups.
The TamperedChef campaign highlights how the presence of a digital signature is no longer sufficient to guarantee the security of an application. Signing an executable with a valid certificate remains a critical measure of trust, but can be circumvented if the certificate itself is obtained fraudulently. Acronis' investigation confirms the need to adopt a multi-layered approach, including EDR/XDR systems, MDR services with continuous monitoring, internal controls on distributed software and training programs aimed at improving the ability to recognize unofficial download sites or suspicious ads.
Acronis EDR and
