Threat Overview

On November 20, 2025, security firm Sand‑Storm released a detailed threat report titled Cooking up Trouble: How TamperedChef Uses Signed Apps to Deliver Stealthy Payloads. The report, authored by Acronis, documents a global cyber‑espionage operation that leverages counterfeit applications signed with legitimate certificates to lure users into installing malicious software. The attackers then use these footholds to deliver payloads that grant remote control over compromised systems.

Actors and Motivation

The threat actor remains unnamed, but the sophistication of the operation suggests an advanced persistent threat (APT) with significant resources. The use of legitimate code signing certificates indicates either a compromised certificate holder or an inside collaborator. The primary objective appears to be espionage, targeting corporate, governmental, and industrial entities for strategic advantage.

Attack Lifecycle

1. Reconnaissance: The attackers identify high‑value targets and gather information on software distribution channels.
2. Weaponization: They create a malicious application that mimics a popular utility (e.g., a cooking recipe manager) and sign it with a stolen or compromised certificate.
3. Delivery: The fake app is distributed through third‑party app stores, phishing emails, and compromised websites.
4. Installation: Users install the application, believing it to be legitimate.
5. Command & Control: Once executed, the payload establishes a covert channel to the attackers’ remote infrastructure.
6. Execution: The adversary can exfiltrate data, deploy additional malware, or pivot to other systems within the network.

Technical Indicators

• Signed binaries with certificates that match known legitimate vendors.
• Domain names that mimic legitimate domains but contain subtle misspellings.
• Use of encrypted communication channels (TLS) to C2 servers.
• Persistence mechanisms such as scheduled tasks and registry modifications.

Detection Strategies

Security analysts should look for the following anomalies:

• Unexpected installation of applications from unverified sources.
• Certificates that do not match the vendor’s public key infrastructure.
• Outbound connections to unfamiliar domains or IP addresses.
• Process creation from unusual directories or with high privilege escalation.

Mitigation Recommendations

1. App Vetting: Enforce strict application whitelisting. Verify the publisher’s identity and cross‑check the certificate chain against trusted authorities.
2. Endpoint Detection & Response (EDR): Deploy EDR solutions that can detect anomalous process behavior and unauthorized persistence mechanisms.
3. Network Segmentation: Isolate critical systems to limit lateral movement. Apply least‑privilege access controls.
4. Security Awareness Training: Educate users about the risks of installing applications from unknown sources and the importance of verifying digital signatures.
5. Certificate Management: Monitor for certificate revocation and employ certificate pinning where possible.
6. Threat Intelligence Integration: Subscribe to feeds that include indicators of compromise (IOCs) from the report, such as malicious domains, IP addresses, and hash values.

Conclusion

The “Cooking up Trouble” report underscores the evolving threat landscape where attackers exploit trust mechanisms like code signing to deliver stealthy payloads. By combining rigorous application vetting, advanced detection capabilities, and user education, organizations can reduce the risk of falling victim to this sophisticated espionage campaign.