Microsoft on Friday said it's investigating an incident wherein a driver signed by the company turned out to be a malicious Windows rootkit that was observed communicating with command-and-control (C2) servers located in China.
The driver, called "Netfilter," is said to target gaming environments, specifically in the East Asian country, with the Redmond-based firm noting that "the actor's goal is to use the driver to spoof their geo-location to cheat the system and play from anywhere."
"The malware enables them to gain an advantage in games and possibly exploit other players by compromising their accounts through common tools like keyloggers," Microsoft Security Response Center (MSRC) said.
It's worth pointing out that Netfilter also refers to a legitimate software package, which enables packet filtering and network address translation for Linux based systems.
Microsoft dubbed the malware "Retliften," alluding to "netfilter" but spelled backwards, adding the malicious driver can intercept network traffic, add new root certificates, set a new proxy server, and modify internet settings without a user's consent.
The rogue code signing was spotted by Karsten Hahn, a malware analyst at German cybersecurity company G Data, who shared additional details of the rootkit, including a dropper, which is used to deploy and install Netfilter on the system.
Upon successful installation, the driver was found to establish connection with a C2 server to retrieve configuration information, which offered a number of functionalities such as IP redirection, among other capabilities to receive a root certificate and even self-update the malware.
The oldest sample of Netfilter detected on VirusTotal dates back to March 17, 2021, Hahn said.
Microsoft noted that the actor submitted the driver for certification through the Windows Hardware Compatibility Program (WHCP), and that the drivers were built by a third-party. The company has since suspended the account and reviewed its submissions for additional signs of malware.
The Windows maker also stressed that the techniques employed in the attack occur post-exploitation, which necessitates that the adversary must have had previously gained administrative privileges so as to be able to install the driver during system startup or trick the user into doing it on their behalf.
Additionally, Microsoft said it intends to refine its partner access policies as well as its validation and signing process to enhance protections further.
"The security landscape continues to rapidly evolve as threat actors find new and innovative methods to gain access to environments across a wide range of vectors," MSRC said, once again highlighting how the trust associated with signed drivers can be exploited by threat actors to facilitate large-scale software supply chain attacks.
