# Impostor Certificates: Threat Actors Impersonating Businesses to Obtain Code-Signing Certificates for SolarMarker and Other Malware

> Research by squiblydoo documents threat actors impersonating legitimate businesses to obtain Authenticode code-signing certificates and sign malware, chiefly SolarMarker. About 100 certificates abused by SolarMarker developers over three years are described, and the author characterizes the pattern as a systemic weakness in certificate issuance and validation.

- **Published:** 2026-11-03T04:51:30Z
- **Last reviewed:** 2026-11-03T04:51:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5120
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5120.png
- **ID:** TL-2026-5120
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** SolarMarker operators
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

In a May 2024 post, security researcher squiblydoo describes how threat actors obtain Authenticode code-signing certificates by impersonating real businesses, and how the SolarMarker operators in particular have used this to sign their malware. The author documents roughly 100 certificates abused by SolarMarker developers over about three years. The operators had a fresh certificate for each week in which they deployed malware. Certificates were regularly revoked and then quickly replaced. Between September 2023 and January 2024 the operators deployed malware multiple times per week, then paused development from January to March 2024. A 2023 presentation by the same author had already identified binaries from 15 malware families signed with SolarMarker-associated certificates. The post also mentions Polazert, YellowCockatoo and internet-janitor as related threats.

The acquisition process described has three steps: (1) select a business from a government business registry; (2) register a related domain and set up a matching email address; (3) receive the certificate authority's validation call, which is a robocall or scripted call, on an attacker-supplied phone number. Once a certificate is issued, impostors sign malware on behalf of developers. The author notes that validation gaps make this easier: there is no inter-CA communication, domain validation is easy to satisfy for businesses with no existing domain, phone verification can be answered by a script, and the extra validation required for EV certificates was insufficient. Impersonated organizations were most often in the United Kingdom, Ukraine, Canada, the United States and Russia, and were mainly in software (41 companies), consulting and manufacturing. Nineteen of the 41 software companies were shell companies registered in Ukraine between September and November 2023 with about USD 25 of shareholder equity each. The cause of this pattern is unclear to the author. The hunt skeleton records that the actors are Russian-speaking, per the article. The author withheld certificate issuers, serials and thumbprints to protect the impersonated businesses.

SolarMarker itself, per eSentire analysis, is a backdoor and infostealer first seen in 2020. It is delivered through SEO poisoning, Google Groups pages and compromised WordPress sites hosting payloads under /wp-content/uploads/formidable/. Large (200MB+) EXE/MSI installers run a decoy program while PowerShell executes an encrypted payload in memory. A .LNK file in the Startup folder provides persistence. The backdoor communicates with C2 over RSA and AES-CBC encrypted JSON. The infostealer targets cryptocurrency wallets, browser credentials and cookies, and VPN/RDP configurations. Note that the eSentire analysis dates to 2022 and the primary source to May 2024, so the IOCs and activity levels should be treated as historical.

Defender recommendations from the source: report abused certificates to the issuing CA promptly (the author's certReport tool automates this from a file hash via MalwareBazaar), and pivot retroactively on abused certificates to find further signed malware. For issuers: strengthen verification, make abuse reporting accessible, and resist market pressure to speed issuance.

## MITRE ATT&CK

- T1588.003 Obtain Capabilities: Code Signing Certificates
- T1583.001 Acquire Infrastructure: Domains
- T1608.006 Stage Capabilities: SEO Poisoning
- T1608.001 Stage Capabilities: Upload Malware
- T1553.002 Subvert Trust Controls: Code Signing
- T1684.001 Impersonation
- T1140 Deobfuscate/Decode Files or Information
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1573.002 Encrypted Channel: Asymmetric Cryptography

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SolarMarker Decoy Installer Spawning PowerShell With Encrypted In-Memory Payload — Exploitation** (`TL-2026-5120-SPL-001`)

Detects the SolarMarker (TL-2026-5120) execution pattern: an oversized EXE/MSI installer launched from a user Downloads or Temp folder, or via msiexec, runs a decoy program while spawning PowerShell that base64-decodes and AES-decrypts a payload in memory (T1204.002, T1059.001, T1140). Behaviour-first: it keys on the parent/child relationship and decryption primitives in the command line rather than on any specific certificate or hash, so it also covers impostor-signed samples.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.001, T1140
- **Data sources:** sysmon, windows_security, defender_for_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") (ParentImage="*\\Downloads\\*" OR ParentImage="*\\AppData\\Local\\Temp\\*" OR ParentImage="*\\msiexec.exe") (CommandLine="*-enc*" OR CommandLine="*FromBase64String*" OR CommandLine="*CreateDecryptor*" OR CommandLine="*Security.Cryptography.Aes*") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host, User, ParentImage, Image | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where InitiatingProcessFolderPath has_any ("Downloads", "Temp") or InitiatingProcessFileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("-enc", "FromBase64String", "CreateDecryptor", "Security.Cryptography.Aes")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: SolarMarker-Style Installer Spawning PowerShell With Encrypted Payload Handling
id: 5b8c2f4e-1a3d-4e6f-9b7a-2c1d8e5f3a01
status: experimental
description: Detects PowerShell launched by an installer in a user Downloads/Temp folder or by msiexec with base64/AES decryption primitives on the command line, matching the SolarMarker decoy-installer execution chain.
references:
  - https://squiblydoo.blog/2024/05/13/impostor-certs/
  - https://esentire.com/blog/esentire-threat-intelligence-malware-analysis-solarmarker
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_parent_path:
    ParentImage|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
  selection_parent_msi:
    ParentImage|endswith: '\msiexec.exe'
  selection_cmd:
    CommandLine|contains:
      - '-enc'
      - 'FromBase64String'
      - 'CreateDecryptor'
      - 'Security.Cryptography.Aes'
  condition: selection_img and selection_cmd and 1 of selection_parent_*
falsepositives:
  - Legitimate software installers that run encoded PowerShell custom actions
  - Admin deployment scripts staged in Temp
level: high
```

**Known false positives:**

- Legitimate MSI/EXE installers whose custom actions run encoded PowerShell via msiexec
- IT deployment tooling that stages scripts in user Temp folders and runs them with -EncodedCommand

**Tuning notes:** Baseline msiexec-to-PowerShell activity for 14 days and exclude known software-deployment parents (SCCM, Intune, Chocolatey) by ParentCommandLine. Raise to critical when the parent binary is over 100MB or has a first-seen signer. Adjust the index name to match your Sysmon index.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Newly Seen Code-Signing Signer on Binary Spawning PowerShell (Impostor Certificate) — Exploitation (locked: unlock with TL Creds)
- PowerShell Launched at Logon via Startup LNK With In-Memory Decryption — Post-Exploitation (locked: unlock with TL Creds)
- Periodic PowerShell Beaconing to Public IP (Encrypted Backdoor C2) — C2 (locked: unlock with TL Creds)
- SolarMarker Payload Download From Formidable Forms Upload Path or Google Groups — Exploitation (locked: unlock with TL Creds)
- Script Engine or Installer Dropping Startup LNK From User-Writable Path — Post-Exploitation (locked: unlock with TL Creds)
- PowerShell Script Block Decrypting and Reflectively Loading Payload in Memory (SolarMarker Backdoor Stage) — C2 (locked: unlock with TL Creds)
- Startup Folder LNK Created by Non-Explorer Process (SolarMarker Persistence) — Post-Exploitation (locked: unlock with TL Creds)
- Connection to Known SolarMarker C2 Infrastructure — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- IP address: `37.120.237[.]251`
- File hash: `89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9`
- IP address: `37.120.233[.]92`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Impostor Certificates (squiblydoo)](https://squiblydoo.blog/2024/05/13/impostor-certs/)
- [eSentire Threat Intelligence: SolarMarker malware analysis](https://esentire.com/blog/esentire-threat-intelligence-malware-analysis-solarmarker)
- [certReport (Squiblydoo) - reporting tool for malicious Authenticode certificates](https://github.com/Squiblydoo/certReport)
- [NCSC Ireland: SolarMarker WordPress Compromise](https://www.ncsc.gov.ie/pdfs/SolarMarker-WordPress-Compromise.pdf)
- [Dark Reading: Impersonation Fraud Still Effective in Obtaining Code Signatures](https://www.darkreading.com/risk/impersonation-fraud-still-effective-in-obtaining-code-signatures)
- [The Register: suspicious digital certificate sales (2018)](https://www.theregister.com/2018/03/12/susicious_digital_cetificate_sales/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5120