Supply Chain Compromise: Signed GoTo Resolve Updater Trojanized with Kepavll Malware

Initial Signal

On January 22, 2026, Microsoft Defender for Endpoint detected a malicious file masquerading as a legitimate software updater on device ws-001. The file `GoToResolveUnattendedUpdater.exe` (SHA-256: d126ebe9704c544636d79e5ffc7782f2d52ac33a82a9459427c7b15115f59615) was identified as Trojan:Win32/Kepavll!rfn malware, mapping to T1547.001 (Registry Run Keys / Startup Folder) persistence techniques. What made this alert significant was the sophistication of the attack: the malicious executable bore a valid digital signature from GoTo Technologies USA, LLC, a trusted software vendor. The file executed from a legitimate installation path (`C:\Program Files (x86)\GoTo Resolve Unattended\...`) as part of what appeared to be a routine software update process, running with SYSTEM privileges at 09:49:03 UTC. The file size of approximately 24 MB was unusually large for a typical updater component, and the global prevalence data showed 3,829 instances of this malware detected within a 23-hour window—a clear indicator of a widespread supply chain compromise. Microsoft Defender successfully terminated the malicious process approximately 24 seconds after execution and blocked further activity. The investigation correlated data from Microsoft Defender for Endpoint alerts, process execution logs, and file analysis across 17 invocations spanning 2 minutes 27 seconds of autonomous analysis.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Disconfirming Evidence

Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. fp1
   Verified malware classification across multiple Microsoft Defender alerts
   Pass
2. fp2
   Analyzed file characteristics and execution context
   Pass
3. fp3
   Evaluated global prevalence and detection timeline
   Pass
4. fp4
   Examined security response and observed behavior
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Malicious at high confidence rests on the following mutually corroborating signals:

1. Three separate Microsoft Defender alerts consistently and definitively classified the file as Trojan:Win32/Kepavll!rfn malware, with runtime behavior analysis (indicated by the !rfn suffix) confirming actual malicious execution, not static signature detection alone

2. The file executed with SYSTEM privileges at 09:49:03 UTC on January 22, 2026, confirmed by DeviceProcessEvents telemetry showing the process creation and subsequent termination at 09:49:27 UTC

3. Global prevalence data showing 3,829 instances of this malware within approximately 23 hours across multiple organizations, with first observation on January 21, 2026, demonstrating a coordinated, widespread campaign rather than an isolated false positive

4. The file's valid digital signature from GoTo Technologies USA, LLC combined with execution from a legitimate installation path indicates a sophisticated supply chain compromise of the GoTo Resolve update mechanism, not a detection error

5. Microsoft Defender's immediate termination of the process and blocking of further activity, combined with the absence of any evidence of legitimate software functionality being impaired, confirms the detection was based on genuine malicious behavior. Confidence is High rather than Confirmed because the investigation did not capture evidence of post-execution persistence mechanisms, lateral movement, or data exfiltration—though the 24-second execution window and immediate process termination by security controls limited the malware's opportunity to perform such actions

Lessons

1. 01
   Valid signatures do not guarantee legitimate code. This investigation demonstrates that a valid digital signature from a trusted vendor (GoTo Technologies USA, LLC) is not a reliable indicator of file legitimacy. The malware bore a genuine signature, yet was definitively classified as Trojan:Win32/Kepavll!rfn. Analysts should never assume that signed executables are safe; instead, correlate signature validity with file hash reputation, prevalence data, and behavioral analysis. When a signed file triggers malware alerts, escalate immediately to the vendor and assume supply chain compromise until proven otherwise.
2. 02
   Global prevalence spikes reveal supply chain attacks. The 3,829 instances of this malware detected globally within 23 hours was the strongest signal that this was not an isolated false positive or targeted attack, but a widespread supply chain compromise. Analysts should establish alerting thresholds for file prevalence anomalies—when a previously unseen file suddenly appears in thousands of detections across multiple organizations, it indicates a coordinated attack affecting the entire customer base of a software vendor. This investigation took 2 minutes 27 seconds to reach that conclusion; without prevalence correlation, manual investigation would have consumed hours.
3. 03
   Execution context matters more than file path legitimacy. The malware executed from `C:\Program Files (x86)\GoTo Resolve Unattended\...`, a legitimate installation directory, as part of a routine update process. This context made the threat harder to spot but also more dangerous—users and automated systems would expect this activity. The key differentiator was the file size (24 MB, unusually large for an updater), the SYSTEM privilege level, and the behavioral detection (runtime analysis via the !rfn suffix). When investigating software updates, scrutinize file size, process privileges, and registry modifications, not just the path legitimacy.
4. 04
   24 seconds of execution is enough for initial compromise. Microsoft Defender terminated the malicious process at 09:49:27 UTC, just 24 seconds after execution began at 09:49:03 UTC. In that brief window, the malware could have registered persistence mechanisms, modified system configuration, or established command-and-control callbacks. The absence of evidence of lateral movement or data exfiltration in the telemetry does not mean the system is uncompromised—it means the security controls were fast enough to prevent post-execution actions. Always assume that any malware execution, however brief, represents a successful initial compromise and warrants full forensic review and credential rotation.
5. 05
   Supply chain compromises require vendor coordination. This investigation identified a malicious GoTo Resolve updater, but the scope extends far beyond ws-001. With 3,829 global detections, thousands of organizations are potentially affected. A single organization's detection is insufficient; this finding must be reported to GoTo Technologies immediately so they can issue a security advisory, revoke the compromised certificate, and push a patched update. Analysts should establish escalation procedures for supply chain incidents that include vendor notification, customer communication, and coordination with industry partners and threat intelligence sharing groups.