TA505 Campaign Climbs Certificate Trust Ladder to Zero-Detection EV Binary

A piracy-lure campaign attributed to TA505 has assembled three distinct code-signing certificate chains — expired Sectigo, valid DigiCert, and a valid Extended Validation certificate issued to DeepL SE — each mapped to a progressively lower antivirus detection rate. The strategy culminates in a 64-bit binary that clears all 76 VirusTotal engines without a single flag, raising unresolved questions about how the threat actor obtained or abused a legitimate EV certificate from a named German software company.