Code-signing certificate abuse in the Black Basta chat leaks (and how to fight back)

Current events · 12 MIN READ · AARON WALTON · MAR 18, 2025 · TAGS: Guidance

TL;DR 

• Code-signing helps computers have confidence in the legitimacy of files, but cybercriminals abuse them too. 
• BlackBasta’s leaked chat logs give us insight into how a ransomware gang leveraged code-signing certificates for their malware campaigns.
• By investigating code-signing certificates and reporting false signings, you can protect yourself and others from malicious activity.

Recently, we (the information security community) received the opportunity to look behind the curtain and see the inner workings of the Black Basta ransomware gang. In this post, we’ll use the opportunity to examine how the ransomware gang used their skill and finances to abuse a core security concept: code-signing certificates.

Core safety via code-signing certificates

Computers have become an essential part of our lives and businesses. To help make this possible, a lot of time has gone into helping ensure systems exist to make using computers safe. One of the core principles to help do this is code-signing certificates. 

Code-signing certificates help solve some basic problems. They help answer the questions “How can I trust this program?” and “How can I trust this program has not been tampered with?”

Code-signing certificates are issued to vetted organizations. This vetting process results in a chain of trust: a root authority trusts a certificate authority, and the certificate authority vets and validates their customers. After validation, the customer is trusted because the certificate authority is trusted.

This chain of trust impacts how web browsers and operating systems handle many files. If the file isn’t signed, many browsers and operating systems will show very clear warnings. However, if they are trusted, those warnings may not appear, or may only be informational.

This system helps us have confidence that a system file or downloaded application is legitimate, and that the developer has been vetted.

It uses public key cryptography to ensure the signatures are valid. When a file is signed, it requires the signing party to have a private key (often tied to a hardware token) to apply a signature to a file. This ensures entities without the private key can’t sign as the software developer.

Signing also protects against file tampering. The signature tied to the file contains a cryptographic hash of the file, and this hash must match the computed file hash of the file, or the signature won’t be seen as valid. If you aren’t familiar with hashing, this is a technique of applying a one-way algorithm to a file to compute a small representation of the file. Any modifications to the file will impact the representation or hash.

These processes work pretty seamlessly: when you’re downloading or running files from trusted sources, the chain of trust helps you feel safe about the file you’re running. Without this system, the user is required to validate a lot of information on their own (such as the source of the download) and calculate their own file hashes to compare against a public list of file hashes.

Abusing code-signing

This code-signing process and transfer of trust works well, but just like anything within cybersecurity, attackers can also leverage the process. Cybercriminals also want to ensure browsers and operating systems trust their files, too, so they’re incentivized to find ways to abuse this system.

In very rare cases, cybercriminals can steal the private key and ‌then sign files as an organization. There are some very well-known cases of this happening, but since the private key is connected to a physical hardware token, usually it’s very uncommon. 

The most common method of abuse today is to impersonate a company and be issued the keys directly. Instead of each bad actor needing to do this themselves, certain attackers specialize in this impersonation and resell the certificates. One well-known seller is Megatraffer, who has been selling certificates for a long time, and was also selling certificates to the Conti ransomware gang.

This type of abuse has been previously written about and published by others. However, we recently got a good look at this type of abuse from the inside: from the chat logs from the Black Basta Ransomware gang.

Chat logs made public 

On February 20, an individual going by ExploitWhispers announced they were publishing chats from the Black Basta ransomware gang. ExploitWhispers stated they did this because Black Basta had crossed the line by compromising a Russian bank.

These types of leaks are valuable to defenders like us because they often expose uncensored discussions between cybercriminals. Several researchers and organizations have also already dug deep into these leaks, observing how bad actors handled the Ascension Healthcare ransomware attack internally, learning about how the gang leader escaped detention in Armenia, or documenting the vulnerabilities and tactics the gang discusses.

The leaks themselves cover time from 2023-09-18 to 2024-09-28. There are almost 200,000 messages, 50 unique users, and 79 chatrooms (source).

From our own visibility, we knew the Black Basta ransomware gang were frequent abusers of code-signing certificates. Specifically, our SOC frequently saw Black Basta sign Pikabot and Darkgate malware they used in phishing campaigns, so we dug in to see what we could learn.

Black Basta’s code-signing abuse

Why sign?

In the early parts of the chatlog (2023-10-06), the bad actors discuss the cost and value of using code-signing certificates (the following machine-translated from Russian and edited for style and clarity.)

The main person handling the certificates goes by “gg” in the chats, and is known to be one of the main leaders of Black Basta. He had formerly been part of the Conti ransomware gang, and is the most active person in the chat logs.

Within the chatlogs, gg frequently talks about handling the signing of files. When he shares the files, they are always nicely labeled, which helps us get a good understanding of their contents. In general, they freely use code-signing certificates and don’t hold back on buying or using them.

In most cases, signed files gg shares are labeled like this: “EV## Impersonated Organization name [Certificate Provider].rar” (for example, “EV44AAA_CLOTHING [SSL.COM].rar”). We can further correlate this particular certificate with a file in the Cert Central database.

Cert Central documented the abuse of a certificate issued by SSL.com to AAA Clothing Limited. They identified the malware as DarkGate malware, and provided the file hash b79b536569c0060a834e4001289a6700692d67df58e644779fababf0df22fc75. This file is also publicly available on VirusTotal.

The chats mention at least 28 certificates. The entire list we identified is provided at the end of this document. Like the AAA Clothing Limited file, most are numbered and follow the pattern mentioned above. The file numbers range from 13 to 101, so the fact that we only have 28 may indicate many more are unaccounted for. Reporting certificates for revocation is important, but with gangs like these, they often have many on hand.

The possibility that they could have had 100+ code-signing certificates isn’t unusual. According to Cert Central, some malware families have been seen signed with code-signing many times. This includes Qakbot, which has been seen signed by impersonated organizations more than 100 times. The gang also signed many different files within a campaign—not just their initial access malware.

The gang uses code-signing for multiple components of their campaign. This includes signing initial access tools (IATs) like Quakbot, Pikabot, and Darkgate; information stealing malware, like Lumma infostealer; tools to hide one’s presence on a computer and network, like SOCKS proxy and Hidden VNC; and their featured remote access tool, Cobalt Strike.

Code-signing certificate abuse is often misunderstood. However, these chats give us a lot of great visibility into how this gang abuses them. We’ve seen how much they pay for them, how liberally they use them (due to their critical role in their campaign), and we’ve seen them used to sign a range of malware.

Leveraging the leaks for good

Just knowing ransomware gangs and other criminals abuse code-signing certificates isn’t enough. It’s important for organizations to leverage that knowledge for their defenses, too. Here’s what you can do.

1. Investigate files with uncommon code-signing signatures.

Malware traffic generation teams (also known as traffers) often sell a service to hide the malicious code (using what is called crypting) and provide code-signing services. As a result, signed malware has a low detection rate, which increases the chances of success. Malware with high detection rates is unlikely to be signed to avoid “spoiling the cert.” 

At Expel, we frequently see malicious advertisements for common apps. These advertisements push low-detection malware. It’s important to investigate the file, because the code-signing certificate can often be an indicator of malicious activity. One way to investigate these is to compare what the file claims to be with its signer. 

In the following image, the file on VirusTotal was uploaded as SlackSetup.exe. It was downloaded from a malicious advertisement for Slack. The file information (which is basically just a text field an attacker can fill in) also claims the file is Slack. However, the certificate signer is “SIAFU LIMITED” and not the expected signer: Slack.

By reviewing and evaluating what the file claims to be versus who has signed the file, analysts can quickly identify whether the file is legitimate, regardless of the detection rate. (At the time of this writing, the file was detected as malicious by four of 68 detection engines. But seeing completely clean malicious files is also fairly common.)

Organizations can manually review these features or use automation and AI. You do you. 🙂

2. Submit reports for abused code-signing certificates.

Certificate providers are really responsive to reports. The certificate provider previously vetted and trusted a customer, so receiving reports of abuse allows them to take action and revoke the certificates. To report a certificate, the file must be publicly available for the provider to validate your claim of abuse. The easiest way to make it available is to upload the file to VirusTotal and give that link to the provider. We also recommend providing a detailed report of the activity you observed indicating abuse, especially if the file is clean in terms of detection. The information you provide helps them identify ‌malicious activity.

The maintainers of Cert Central also have a tool called certReport, which can generate abuse reports in a few seconds and direct you on where to report the certificate. This tool leverages VirusTotal to collect the important details on the certificate, as well as any suspicious indicators identified by VirusTotal.

Reporting the certificate can also: 

• Costs criminals money. As mentioned in the leaks, code-signing certificates regularly cost $4,000 or more, because obtaining the certificate takes a lot of work. Reporting the certificate causes criminals to have to spend even more money, or risk having a completely useless campaign.
• Disrupt future downloads. When a certificate is revoked, the file is now viewed as worse than an unsigned file. Both browsers and operating systems will reject a revoked certificate as explicitly untrusted. This can help protect users in your organization and outside your organization from downloading the same malware.
• Disrupt malware delivery. As seen in the chats, when a certificate is revoked, the certificate can’t sign files anymore. This can disrupt campaigns where a bad actor is trying to deliver signed files. We regularly see malware traffic teams disrupted due to the revocation of their certificates.
• Help defenders identify malware. Since most certificates issued to impostors are used to sign multiple files, they all become suspect once one is reported. When certificates aren’t revoked, they are reused across malware. Identifying other files with a malicious certificate can help identify low-detection malware that can then be investigated and analyzed to build new detections to find them the next time they are seen.

Black Basta’s known certificates

The following table contains the certificates mentioned in the chats. We checked to see if they were publicly known in the Cert Central database. If they were known, the file hash was provided. 

This list was also provided to the certificate issuers listed in the table for their awareness.

Use horizontal scroll to view full table on mobile.

* While two certificates can’t both be EV44, these numbers are directly from the chat and could not be confirmed.