Wiki › Techniques, Tactics & Procedures (TTPs) › Initial Access › Trojanized Software Installers

Trojanized Software Installers

3 min read

Jump to:

Overview

Trojanized software installers are legitimate-looking installation packages that have been modified to include malicious code. Adversaries use this technique to gain initial access, execute payloads, and maintain persistence by tricking users into installing compromised software. This approach leverages user trust in familiar software to bypass security controls and facilitate various stages of an attack lifecycle.

Attack Objective

Primary goal: Initial access, execution, persistence, and privilege escalation
Stages supported: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion
Advances attacker position by delivering and executing malicious payloads under the guise of trusted software, enabling stealthy footholds and further exploitation

How the Technique Works

Adversaries obtain legitimate software installers and modify them to include malicious components such as backdoors, remote access tools, or credential stealers. These trojanized installers are then distributed through various channels, including compromised websites, phishing campaigns, or third-party download sites. When a user executes the installer, the embedded malware is deployed alongside or instead of the legitimate software, often running with the same privileges as the user to evade detection and facilitate subsequent attack actions.

Common Methods & Variations

Embedding malicious payloads within popular software installers or repackaging software with added malware
Distribution via on-premises environments, cloud-based download portals, or software update mechanisms
Use of living-off-the-land binaries to execute malicious code or custom-built trojanized installers tailored to specific targets

Indicators of Compromise (IOCs)

Unexpected network connections initiated by installed software
File hashes or digital signatures that do not match known legitimate installers
Unusual process creation events or execution of installers from uncommon paths
Endpoint alerts for unauthorized modifications to software installers
Suspicious command-line arguments or child processes spawned by installer executables

Detection Strategies

Monitoring file integrity and verifying digital signatures of installers
Behavioral analysis of installer execution, including process spawning and network activity
Correlation of endpoint telemetry with network logs to identify anomalous communications post-installation
Use of sandbox environments to analyze installer behavior before deployment

Mitigation & Prevention

Enforce application whitelisting and restrict execution of unauthorized installers
Implement strict digital signature verification and code signing policies
Educate users on risks of downloading software from untrusted sources
Use endpoint protection solutions capable of detecting tampered installers and suspicious behaviors
Apply network segmentation and monitoring to limit and detect unauthorized software distribution

Response Considerations

Immediately isolate affected systems to prevent lateral movement
Conduct forensic analysis to identify the scope of compromise and malicious payloads delivered
Revoke or reset credentials potentially exposed through the trojanized software
Remove trojanized installers and any associated malware; restore systems from known good backups
Review and strengthen software procurement and update processes to prevent recurrence

Related Techniques

Phishing for initial access to distribute trojanized installers
Supply chain compromise involving software update mechanisms
Living-off-the-land binaries to execute malicious payloads post-installation
Persistence through scheduled tasks or services installed by trojanized software

Mapping & References

MITRE ATT&CK Tactics: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion
MITRE ATT&CK Techniques: T1195 (Supply Chain Compromise), T1543 (Create or Modify System Process), T1204 (User Execution)
Public research and advisories on software supply chain attacks and trojanized installers from cybersecurity vendors and CERTs

Tags: Defense Evasion endpoint security Execution Incident Response Initial Access Malware Delivery persistence privilege escalation software supply chain Threat Detection Trojanized Installers