Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 16:14:04 UTC
Home > List all groups > List all tools > List all groups using tool SIGFLIP
 Tool: SIGFLIP
Names SIGFLIP
Category Malware
Type Poisoning
Description
(Mandiant) SigFlip is a tool for patching authenticode signed PE-COFF files to inject arbitrary
code without affecting or breaking the file's signature.
Information <https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise>
Last change to this tool card: 26 April 2023
Download this tool card in JSON format
All groups using tool SIGFLIP
Changed Name Country Observed
APT groups
  Lazarus Group, Hidden Cobra, Labyrinth Chollima 2007-May 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=05836c6c-5f9e-4478-874a-2e0c0ea3334b
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=05836c6c-5f9e-4478-874a-2e0c0ea3334b
Page 1 of 1