Technique T1553

Subvert Trust Controls

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Subvert Trust Controls (T1553) — a Defense Evasion technique, observed in public incident reporting.

MITRE ATT&CKT1553

TacticDefense Evasion

Incidents on file14

Detection & mitigation

Monitor for unusual access to source code repositories and unexpected changes in dependencies. Implement software composition analysis and integrity checks on third-party libraries.

Observed in the wild

2026-09-21

code signing abuse
CrowdSec Confirms Source Code Stolen in Supply Chain Attack

2026-09-18

code signing abuse
Plugin4Shell Zero-Click RCE Affects AI Coding Agents

2026-09-03

code signing abuse
Attackers Abuse Signed Node.js Binaries and Ethereum Smart Contracts for Evasive C2

2026-09-02

code signing abuse
Attackers Conceal Reverse Shell Traffic via Signed Apps and AWS API Gateway

2026-05-23

code signing abuse
CVE-2013-3900: WinVerifyTrust Signature Validation Weakness

2026-05-20

code signing abuse
TamperedChef Malware Campaign Uses Signed Trojanized Apps to Deliver Stealers and RATs

2026-05-20

code signing abuse
Fox Tempest Malware-Signing Service Abused Microsoft Artifact Signing to Certify Malware

2026-05-14

code signing abuse
OpenAI employee devices breached via TanStack supply chain attack

2026-05-04

code signing abuse
DigiCert Support Systems Breached, EV Code-Signing Certificates Fraudulently Issued and Used to Sign Malware

2025-06-19

code signing abuse
Signature Kid Tool Demonstrates Digital Signature Spoofing to Bypass Kernel-Mode Protections

2024-08-06

code signing abuse
Elastic Security Labs Details Bypass Techniques for Windows Smart App Control and SmartScreen

2024-05-10

code signing abuse
REvil Ransomware Gang Exploits Kaseya VSA Zero-Days in Supply-Chain Attack

2024-04-26

code signing abuse
Windows SmartScreen Security Feature Bypass Vulnerability (CVE-2023-24880)

2023-10-25

code signing abuse
Proof-of-Concept Exploit for CVE-2023-41991 CoreTrust Bypass Published

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →