Apart from the infamous Superfish/Lenovo case this year, are there any other known cases of a malicious root certificate being installed on a target machine to allow transparent MITM attacks, whether by a foreign government, intelligence service, employer or Russian hacker ?
The same software library that Superfish uses is present in other products beside those found in Lenovo products last year: http://www.tripwire.com/state-of-security/latest-security-news/researchers-reveal-evidence-of-other-superfish-style-attacks-in-the-wild/
Then there are the 2011 Comodo and DigiNotar breaches, which may be the most famous, early root certificate compromises as they were commercial Certificate Authority vendors. Their root certificates were already trusted by most, if not all, browsers at the time. The breaches included the issuance of false certificates impersonating Google, Yahoo, and others.