Quick question for the hunters: what’s the earliest publicly documented case of malware shipping a legitimately signed Windows kernel driver? My notes say Stuxnet in mid-2010 using stolen Realtek (and later JMicron) certs, but I’m validating timelines for a risk brief — any verifiable earlier instance?
But when validating timelines, I cross-check the Authenticode timestamp against the cert’s revocation date; for Stuxnet that’s Realtek 2010-07–14 (revoked 07–16) and JMicron 2010-07–17 (revoked 07–22), cf. https://www.microsoft.com/security/blog/2010/07/17/stuxnet-signed-with-stolen-certificates/. Closest earlier I’ve verified was TDSS bundling a legit vulnerable driver (gdrv.sys) in late 2009, but that’s BYOVD rather than a stolen-cert malicious driver — are you counting those?
I haven’t seen a verifiable pre‑2010 case with a stolen cert; the closest borderline earlier example is the Sony BMG XCP DRM rootkit (2005), which shipped a signed kernel driver but wasn’t criminal malware; Mark Russinovich’s write‑up is a good reference: Archived MSDN and TechNet Blogs | Microsoft Learn. For timeline sanity checks, I run sigcheck -i on the.sys and confirm the EKU and embedded timestamp line up with the claimed release window. Does that meet your criteria, or are you strictly counting threat‑actor use of stolen code‑signing certs before Stuxnet?