Technique T1553

Subvert Trust Controls

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Subvert Trust Controls (T1553) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1553

TacticDefense Evasion

Incidents on file15

Detection & mitigation

Monitor for unauthorized local access attempts and audit use of the pkcrypto passkey component. Apply vendor patch when available and restrict local access to the Guardium system.

Observed in the wild

2026-10-08

code signing abuse
IBM Guardium Data Protection 12.2 hard-coded recovery key and weak crypto in pkcrypto passkey

2026-09-21

code signing abuse
CrowdSec Confirms Source Code Stolen in Supply Chain Attack

2026-09-18

code signing abuse
Plugin4Shell Zero-Click RCE Affects AI Coding Agents

2026-09-03

code signing abuse
Attackers Abuse Signed Node.js Binaries and Ethereum Smart Contracts for Evasive C2

2026-09-02

code signing abuse
Attackers Conceal Reverse Shell Traffic via Signed Apps and AWS API Gateway

2026-05-23

code signing abuse
CVE-2013-3900: WinVerifyTrust Signature Validation Weakness

2026-05-20

code signing abuse
TamperedChef Malware Campaign Uses Signed Trojanized Apps to Deliver Stealers and RATs

2026-05-20

code signing abuse
Fox Tempest Malware-Signing Service Abused Microsoft Artifact Signing to Certify Malware

2026-05-14

code signing abuse
OpenAI employee devices breached via TanStack supply chain attack

2026-05-04

code signing abuse
DigiCert Support Systems Breached, EV Code-Signing Certificates Fraudulently Issued and Used to Sign Malware

2025-06-19

code signing abuse
Signature Kid Tool Demonstrates Digital Signature Spoofing to Bypass Kernel-Mode Protections

2024-08-06

code signing abuse
Elastic Security Labs Details Bypass Techniques for Windows Smart App Control and SmartScreen

2024-05-10

code signing abuse
REvil Ransomware Gang Exploits Kaseya VSA Zero-Days in Supply-Chain Attack

2024-04-26

code signing abuse
Windows SmartScreen Security Feature Bypass Vulnerability (CVE-2023-24880)

2023-10-25

code signing abuse
Proof-of-Concept Exploit for CVE-2023-41991 CoreTrust Bypass Published

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →