Impostor Certificates: Threat Actors Impersonating Businesses to Obtain Code-Signing Certificates for SolarMarker and Other Malware

Key facts for SolarMarker impostor certs

Detection coverage for SolarMarker impostor certs

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5120 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SolarMarker Decoy Installer Spawning PowerShell With Encrypted In-Memory Payload — Exploitation

Detects the SolarMarker (TL-2026-5120) execution pattern: an oversized EXE/MSI installer launched from a user Downloads or Temp folder, or via msiexec, runs a decoy program while spawning PowerShell that base64-decodes and AES-decrypts a payload in memory (T1204.002, T1059.001, T1140). Behaviour-first: it keys on the parent/child relationship and decryption primitives in the command line rather than on any specific certificate or hash, so it also covers impostor-signed samples.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1059.001, T1140
• Data sources: sysmon, windows_security, defender_for_endpoint
• Severity: high
• Confidence: medium

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (ParentImage="*\\Downloads\\*" OR ParentImage="*\\AppData\\Local\\Temp\\*" OR ParentImage="*\\msiexec.exe") (CommandLine="*-enc*" OR CommandLine="*FromBase64String*" OR CommandLine="*CreateDecryptor*" OR CommandLine="*Security.Cryptography.Aes*") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host, User, ParentImage, Image | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where InitiatingProcessFolderPath has_any ("Downloads", "Temp") or InitiatingProcessFileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("-enc", "FromBase64String", "CreateDecryptor", "Security.Cryptography.Aes")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, FileName, ProcessCommandLine

Sigma

title: SolarMarker-Style Installer Spawning PowerShell With Encrypted Payload Handling
id: 5b8c2f4e-1a3d-4e6f-9b7a-2c1d8e5f3a01
status: experimental
description: Detects PowerShell launched by an installer in a user Downloads/Temp folder or by msiexec with base64/AES decryption primitives on the command line, matching the SolarMarker decoy-installer execution chain.
references:
  - https://squiblydoo.blog/2024/05/13/impostor-certs/
  - https://esentire.com/blog/esentire-threat-intelligence-malware-analysis-solarmarker
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_parent_path:
    ParentImage|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
  selection_parent_msi:
    ParentImage|endswith: '\msiexec.exe'
  selection_cmd:
    CommandLine|contains:
      - '-enc'
      - 'FromBase64String'
      - 'CreateDecryptor'
      - 'Security.Cryptography.Aes'
  condition: selection_img and selection_cmd and 1 of selection_parent_*
falsepositives:
  - Legitimate software installers that run encoded PowerShell custom actions
  - Admin deployment scripts staged in Temp
level: high

Known false positives:

• Legitimate MSI/EXE installers whose custom actions run encoded PowerShell via msiexec
• IT deployment tooling that stages scripts in user Temp folders and runs them with -EncodedCommand

Tuning notes: Baseline msiexec-to-PowerShell activity for 14 days and exclude known software-deployment parents (SCCM, Intune, Chocolatey) by ParentCommandLine. Raise to critical when the parent binary is over 100MB or has a first-seen signer. Adjust the index name to match your Sysmon index.

• 🔒 Newly Seen Code-Signing Signer on Binary Spawning PowerShell (Impostor Certificate) — Exploitation · unlock with TL Creds
• 🔒 PowerShell Launched at Logon via Startup LNK With In-Memory Decryption — Post-Exploitation · unlock with TL Creds
• 🔒 Periodic PowerShell Beaconing to Public IP (Encrypted Backdoor C2) — C2 · unlock with TL Creds
• 🔒 SolarMarker Payload Download From Formidable Forms Upload Path or Google Groups — Exploitation · unlock with TL Creds
• 🔒 Script Engine or Installer Dropping Startup LNK From User-Writable Path — Post-Exploitation · unlock with TL Creds
• 🔒 PowerShell Script Block Decrypting and Reflectively Loading Payload in Memory (SolarMarker Backdoor Stage) — C2 · unlock with TL Creds
• 🔒 Startup Folder LNK Created by Non-Explorer Process (SolarMarker Persistence) — Post-Exploitation · unlock with TL Creds
• 🔒 Connection to Known SolarMarker C2 Infrastructure — C2 · unlock with TL Creds

Indicators of compromise for SolarMarker impostor certs

As of 2026-11-03, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-5120.

Sample indicators (3 of 21)

• IP address: 37.120.237[.]251
• File hash: 89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9
• IP address: 37.120.233[.]92

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

How SolarMarker impostor certs works

In a May 2024 post, security researcher squiblydoo describes how threat actors obtain Authenticode code-signing certificates by impersonating real businesses, and how the SolarMarker operators in particular have used this to sign their malware. The author documents roughly 100 certificates abused by SolarMarker developers over about three years. The operators had a fresh certificate for each week in which they deployed malware. Certificates were regularly revoked and then quickly replaced. Between September 2023 and January 2024 the operators deployed malware multiple times per week, then paused development from January to March 2024. A 2023 presentation by the same author had already identified binaries from 15 malware families signed with SolarMarker-associated certificates. The post also mentions Polazert, YellowCockatoo and internet-janitor as related threats.

The acquisition process described has three steps: (1) select a business from a government business registry; (2) register a related domain and set up a matching email address; (3) receive the certificate authority's validation call, which is a robocall or scripted call, on an attacker-supplied phone number. Once a certificate is issued, impostors sign malware on behalf of developers. The author notes that validation gaps make this easier: there is no inter-CA communication, domain validation is easy to satisfy for businesses with no existing domain, phone verification can be answered by a script, and the extra validation required for EV certificates was insufficient. Impersonated organizations were most often in the United Kingdom, Ukraine, Canada, the United States and Russia, and were mainly in software (41 companies), consulting and manufacturing. Nineteen of the 41 software companies were shell companies registered in Ukraine between September and November 2023 with about USD 25 of shareholder equity each. The cause of this pattern is unclear to the author. The hunt skeleton records that the actors are Russian-speaking, per the article. The author withheld certificate issuers, serials and thumbprints to protect the impersonated businesses.

SolarMarker itself, per eSentire analysis, is a backdoor and infostealer first seen in 2020. It is delivered through SEO poisoning, Google Groups pages and compromised WordPress sites hosting payloads under /wp-content/uploads/formidable/. Large (200MB+) EXE/MSI installers run a decoy program while PowerShell executes an encrypted payload in memory. A .LNK file in the Startup folder provides persistence. The backdoor communicates with C2 over RSA and AES-CBC encrypted JSON. The infostealer targets cryptocurrency wallets, browser credentials and cookies, and VPN/RDP configurations. Note that the eSentire analysis dates to 2022 and the primary source to May 2024, so the IOCs and activity levels should be treated as historical.

Defender recommendations from the source: report abused certificates to the issuing CA promptly (the author's certReport tool automates this from a file hash via MalwareBazaar), and pivot retroactively on abused certificates to find further signed malware. For issuers: strengthen verification, make abuse reporting accessible, and resist market pressure to speed issuance.

MITRE ATT&CK techniques by tactic:

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1204.002 User Execution: Malicious File

Defense Evasion

T1140 Deobfuscate/Decode Files or Information; T1684.001 Impersonation

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing

Credential Access

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Command and Control

T1573.002 Encrypted Channel: Asymmetric Cryptography

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1588.003 Obtain Capabilities: Code Signing Certificates; T1608.001 Stage Capabilities: Upload Malware; T1608.006 Stage Capabilities: SEO Poisoning

Remediation for SolarMarker impostor certs

Immediate actions

• Report abused code-signing certificates to the issuing certificate authority (e.g., with certReport using the SHA-256 of a signed sample)
• Retroactively search for other binaries signed with any certificate confirmed as abused
• Block known SolarMarker C2 IPs at the perimeter and hunt for historical connections
• Hunt for .LNK files in user Startup folders launching encrypted PowerShell payloads

Workarounds

• Download software only from vendor-controlled sites rather than search-result links
• Apply application control policies keyed to specific trusted publishers

Longer-term hardening

• Do not treat a valid Authenticode signature as sufficient trust; combine it with reputation, prevalence and publisher allow-listing
• Alert on newly seen signers and on signers with short certificate lifetimes
• Restrict execution of unsigned or unusually large installers downloaded via search results
• Certificate issuers should strengthen business verification, make abuse reporting accessible and avoid speeding up issuance under market pressure

Affected and fixed versions

• Certificate authorities (not named in source) — Authenticode code-signing certificate issuance and validation

Timeline of SolarMarker impostor certs

• 2021-08-08 locked-ioc-20 actors uploaded 501 payloads in one day, per eSentire analysis.
• 2022-04-04 Most recent locked-ioc-20 backdoor sample analyzed by eSentire was compiled; activity was significant through April 2022.
• 2023-09-01 From September 2023 (month precision) locked-ioc-20 deployed malware multiple times per week, and Ukrainian shell companies (about USD 25 equity each) began to be registered; the registrations ran through November 2023.
• 2023-11-30 Registration window for the 19 Ukrainian shell companies ended in November 2023 (month precision); 41 software companies in total were impersonated or abused.
• 2024-01-01 locked-ioc-20 paused development from January to March 2024 (month precision), after the multiple-deployments-per-week period ended.
• 2024-05-13 squiblydoo published 'Impostor Certificates', documenting about 100 certificates abused by locked-ioc-20 over three years and the business-impersonation acquisition process.

Sources cited for SolarMarker impostor certs

• NCSC Ireland: SolarMarker WordPress Compromise ncsc.gov.ie · Advisory
• eSentire Threat Intelligence: SolarMarker malware analysis esentire.com · Research
• certReport (Squiblydoo) - reporting tool for malicious Authenticode certificates GitHub · Code repository
• Impostor Certificates (squiblydoo) squiblydoo.blog · Blog · 2024-05-13
• Dark Reading: Impersonation Fraud Still Effective in Obtaining Code Signatures Dark Reading · News
• The Register: suspicious digital certificate sales (2018) The Register · News · 2018-03-12

More in malware

• Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.)
• SolarMarker: Actions-On-Target — On-Device Fraud via Custom VNC (Saturn) and Browser Data Theft
• Spamhaus Botnet Threat Update January to June 2025: 26% Rise in Botnet C&C Activity
• ScarfaceStealer: Sandbox-Aware Anti-Analysis and Blockchain-Based C2 Configuration (Electron/NSIS Loader)
• VOLTA-AUTODOXER: AI-Powered Windows Infostealer Ranks Stolen Data by Monetization Value