This is not the first time attackers have used trusted software updates to infect systems. The infamous
Flame spy tool, developed by some of the same attackers behind
Stuxnet, was the first known attack to trick users in this way by
hijacking the Microsoft Windows updating tool on machines to infect computers. Flame, discovered in 2012, was signed with an unauthorized Microsoft certificate that attackers tricked Microsoft’s system into issuing to them. The attackers in that case did not actually compromise Microsoft’s update server to deliver Flame. Instead, they were able to redirect the software update tool on the machines of targeted customers so that they contacted a malicious server the attackers controlled instead of the legitimate Microsoft update server.
