Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.)

Key facts for Certified Bad EV abuse

Detection coverage for Certified Bad EV abuse

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5122 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Shared Impostor EV Certificate: One Signer Vouching for Unrelated Binaries in User-Writable Paths (SolarMarker et al.) — Exploitation Phase

Detects the signer-reuse pattern from the 'Certified Bad' research (TL-2026-5122): a single valid Authenticode signer that signs several distinct hashes and products loaded from Downloads, AppData, Temp or ProgramData on a small number of hosts. Impostor-obtained EV certificates are sold as signing-as-a-service, so the same subject signs SolarMarker, ZLoader, IcedID, Qakbot, Cobalt Strike and other unrelated families. A valid signature alone is not a trust signal; this rule keys on signer collisions instead. SPL is the authoritative flavor (Sysmon EventCode 7 exposes Signature/SignatureStatus); KQL uses DeviceFileCertificateInfo; Sigma uses a value_count correlation over an image_load base rule.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1553.002, T1588.003, T1204.002
• Data sources: sysmon, splunk:index=sysmon, DeviceFileCertificateInfo, DeviceProcessEvents
• Severity: medium
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 Signed=true SignatureStatus=Valid earliest=-7d (ImageLoaded="*Downloads*" OR ImageLoaded="*AppData*" OR ImageLoaded="*Temp*" OR ImageLoaded="*ProgramData*") NOT Signature IN ("Microsoft Corporation","Microsoft Windows") ```TL-2026-5122 shared impostor EV certificate: one Authenticode signer vouching for several unrelated products and hashes is the reuse pattern seen across SolarMarker, ZLoader, IcedID, Qakbot and Cobalt Strike samples``` | rex field=Hashes "SHA256=(?<sha256>[A-Fa-f0-9]{64})" | stats dc(sha256) AS distinct_hashes dc(Product) AS distinct_products dc(Company) AS distinct_companies dc(host) AS host_count values(OriginalFileName) AS original_names values(ImageLoaded) AS sample_paths min(_time) AS first_seen max(_time) AS last_seen BY Signature | where distinct_hashes>=3 AND distinct_products>=2 AND host_count<=10 | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table Signature distinct_hashes distinct_products distinct_companies host_count original_names sample_paths first_seen last_seen

Microsoft KQL

// TL-2026-5122: one Authenticode signer vouching for several unrelated products (shared impostor EV certificate)
let lookback = 7d;
let signers = DeviceFileCertificateInfo
| where Timestamp > ago(lookback)
| where IsSigned == true and IsTrusted == true
| where Signer !in~ ("Microsoft Corporation", "Microsoft Windows")
| summarize arg_max(Timestamp, Signer, Issuer, CertificateSerialNumber) by SHA1;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FolderPath has_any ("Downloads", "AppData", "Temp", "ProgramData")
| join kind=inner signers on SHA1
| summarize DistinctHashes = dcount(SHA256), DistinctProducts = dcount(ProcessVersionInfoProductName), DistinctCompanies = dcount(ProcessVersionInfoCompanyName), DeviceCount = dcount(DeviceId), SampleFiles = make_set(FileName, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by Signer, Issuer, CertificateSerialNumber
| where DistinctHashes >= 3 and DistinctProducts >= 2 and DeviceCount <= 10
| order by DistinctHashes desc

Sigma

title: Valid-Signed Image Load From User-Writable Path (Shared EV Certificate Signer Base)
name: tl_2026_5122_signed_userpath_imageload
id: b1e0c7a4-5d2f-4c8e-9a31-7f6d2e8c1a01
status: experimental
description: Base rule for TL-2026-5122. Image loaded from a user-writable path with a valid Authenticode signature from a non-Microsoft signer. The correlation rule below fires when one signer vouches for several distinct hashes, the shared impostor EV certificate pattern seen with SolarMarker, IcedID and ZLoader.
references:
  - https://squiblydoo.blog/2023/05/12/certified-bad/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.defense-evasion
  - attack.t1553.002
  - attack.execution
  - attack.t1204.002
  - attack.resource-development
  - attack.t1588.003
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Signed: 'true'
    SignatureStatus: 'Valid'
    ImageLoaded|contains:
      - '\Downloads\'
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
  filter_microsoft:
    Signature:
      - 'Microsoft Corporation'
      - 'Microsoft Windows'
  condition: selection and not filter_microsoft
falsepositives:
  - Third-party software updaters that stage signed binaries in AppData or Temp
level: informational
---
title: Shared Authenticode Signer Across Multiple Distinct Binaries (Certified Bad)
id: 3c9a5e72-1b4d-4f60-8e27-a5d9c4b30f02
status: experimental
description: Fires when one Authenticode signer is seen on three or more distinct file hashes loaded from user-writable paths within seven days, the signer-sharing pattern across malware families described in TL-2026-5122.
references:
  - https://squiblydoo.blog/2023/05/12/certified-bad/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.defense-evasion
  - attack.t1553.002
  - attack.execution
  - attack.t1204.002
  - attack.resource-development
  - attack.t1588.003
correlation:
  type: value_count
  rules:
    - tl_2026_5122_signed_userpath_imageload
  group-by:
    - Signature
  timespan: 7d
  condition:
    gte: 3
    field: Hashes
falsepositives:
  - Small ISVs that sign several in-house tools with one certificate
level: high

Known false positives:

• Legitimate ISVs that sign several distinct products with one corporate certificate and distribute them through user-writable installer paths
• Software updaters (Electron apps, game launchers) that stage signed binaries in AppData or Temp

Tuning notes: Raise distinct_hashes or distinct_products for noisy estates, widen host_count if your fleet is large, and add an allow-list of known ISV signers (Google, Zoom, Adobe, JetBrains). Enrich hits with certificate issuer (Certum EV) and certificate age, since most abused certificates were used within 50 days of issuance. Review the signer thumbprint against threat-intel before blocking.

• 🔒 Valid-Signed Executable With Publisher Metadata Mismatch in User-Writable Path (Impostor EV Certificate) — Exploitation Phase · unlock with TL Creds
• 🔒 Fake Python Installer Not Published by Python Software Foundation (JuiceLedger / JuiceStealer Lure) — Post-Exploitation · unlock with TL Creds
• 🔒 Beacon-Like Periodic Web Connections From User-Writable Path Executables (Cobalt Strike / Remcos / NetSupport / SolarMarker Style C2) — C2 · unlock with TL Creds
• 🔒 Execution or Load of Known Impostor-EV-Signed Samples (SolarMarker, JuiceLedger, Lock-Screen, Unknown RAT, Proof-of-Value) — Exploitation Phase · unlock with TL Creds
• 🔒 Remcos RAT Registry Configuration Key Creation — Post-Exploitation · unlock with TL Creds
• 🔒 NetSupport RAT Gateway Beacon (NetSupport Manager User-Agent and fakeurl.htm POST) — C2 · unlock with TL Creds
• 🔒 NetSupport RAT Client (client32.exe) Executed Outside Vendor Install Directory — Post-Exploitation · unlock with TL Creds
• 🔒 Network Contact With Community-Observed Sibling Infrastructure (Remcos / NetSupport / Cobalt Strike OSINT) — C2 · unlock with TL Creds

Indicators of compromise for Certified Bad EV abuse

As of 2026-11-03, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-5122.

Sample indicators (3 of 19)

• File hash: 38f3f04bb595286e49939a02dbc369d49516b421e2828557cba7f286ca85bf70
• File hash: 0f069b41245d76dd228b512cc1f3bac12e656bcd1b5415c30048bfdba2f5e208
• File hash: 4630b0be7226c9003d34717f7eb092eb51242bd9723d118b4b106c9727503a7b

Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.

How Certified Bad EV abuse works

In the research 'Certified Bad' (squiblydoo, presented at SLEUTHCON, published 2023-05-12), the author tracked 50 Authenticode code-signing certificates over more than two years, analyzing 698 signed files on VirusTotal. The certificates, marketed by Certum (Certum.EU / Certum.PL) as Extended Validation (EV) certificates conferring browser and SmartScreen trust benefits, were all assessed to have been issued to impostors rather than stolen: no legitimate files from the organizations named on the certificates were found among the 698 binaries.

EV issuance involves three stages: government-database checks that the company exists, domain control validation, and a robotic verification call to a phone number, after which a two-factor hardware/virtual token is issued for signing. The impostors defeat this process by impersonating legitimate organizations. After issuance, the operator builds a 'Proof of Value' by signing a benign 'Hello World' program and uploading it to VirusTotal, which demonstrates the certificate's capability to prospective buyers. The operator then sells signing services to multiple threat actors, so the same certificate signs unrelated malware families and creates common threads between otherwise competing actors.

Fourteen distinct families were identified as sharing certificates, including SolarMarker, ZLoader, IcedID, Chromeloader (412 samples, mostly impostor testing uploads), CobaltStrike, Qakbot, NetSupportRAT, RemcosRAT, BazaarLoader, JuiceLedger, Neshta, lock-screen malware and an unknown RAT. Most certificates were abused within 50 days of issuance, many within the first day or week, and some up to 600 days after issuance; one example certificate remained in abuse for more than 455 days before revocation. In one example timeline, the Hello World proof was uploaded on day 0, lock-screen malware was signed on day 31, and a SolarMarker binary was signed on day 53.

Revocation was slow. A certificate tied to the JuiceLedger activity, reported by SentinelLabs on 2022-09-01, kept being used to sign malware including IcedID and SolarMarker until it was revoked on 2023-01-25, a gap of roughly 147 days during which multiple actors could use it. SentinelLabs/Checkmarx research from September 2022 describes JuiceLedger evolving from fraudulent Python installers carrying the .NET 'JuiceStealer' infostealer (early 2022) to PyPI phishing and supply-chain poisoning (August 2022). Recorded Future separately documents SolarMarker (aka Yellow Cockatoo, Jupyter Infostealer) using Authenticode certificates and oversized compressed archives to evade antivirus, with a multi-tiered C2 infrastructure of primary and secondary clusters, rapid rebuilds after compromise, and targeting of education, healthcare, government, hospitality and SMEs. Related industry research (Intrinsec, August 2024) places EV certificates at $2,000-$6,500 on underground forums, and an NDSS 2026 study counted 43,286 abused certificates in 3,216,113 signed malicious PEs across 46 CAs, including 3,484 polymorphic certificate clusters used to circumvent revocation. Severity is an analyst estimate; no CVE or CVSS applies.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.001 Obfuscated Files or Information: Binary Padding; T1684.001 Impersonation

Execution

T1204.002 User Execution: Malicious File

Command and Control

T1219 Remote Access Tools

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing

Resource Development

T1588.003 Obtain Capabilities: Code Signing Certificates

Remediation for Certified Bad EV abuse

Immediate actions

• Hunt for executables signed by the certificates reported in the source and block or alert on them
• Do not treat a valid EV signature alone as a trust signal; require reputation, provenance and behavioral checks
• Report abused certificates to the issuing CA (e.g. Certum) to request revocation

Workarounds

• Restrict execution of newly signed, low-prevalence binaries downloaded from the internet
• Provide user training on fake installer downloads

Longer-term hardening

• Deploy application allow-listing keyed on publisher plus file hash rather than signature validity alone
• Track signer subject names and thumbprints seen across multiple unrelated malware families and alert on collisions
• Deploy EDR with behavioral detection of loaders, RATs and infostealers regardless of signature status

Affected and fixed versions

• Certum (Asseco Data Systems) — EV Code Signing certificates / Authenticode trust
  Vulnerable versions: Certificates issued to impostors via identity fraud (50 tracked)
• Microsoft — Windows Authenticode / SmartScreen reputation
  Vulnerable versions: All versions relying on signature validity as a trust signal

Timeline of Certified Bad EV abuse

• 2022-09-01 SentinelLabs notified about a certificate tied to locked-ioc-12 activity; the certificate remained usable
• 2022-09-02 Sonatype's weekly malware roundup follows up on the locked-ioc-12 PyPI phishing campaign, which SentinelLabs and Checkmarx reported in September 2022
• 2023-01-25 The certificate tied to the locked-ioc-12 report was revoked after roughly 147 days of continued abuse by locked-ioc-16, locked-ioc-11 and others
• 2023-05-12 'Certified Bad' published and presented at SLEUTHCON: 50 certificates, 698 files, 14 malware families sharing certificates
• 2024-08-01 Intrinsec report on the underground EV code-signing certificate market (priced $2,000-$6,500) covered by CyberInsider
• 2024-11-07 Source page last updated by the author

Sources cited for Certified Bad EV abuse

• CA/Browser Forum EV Code Signing Guidelines cabforum.org · Advisory
• Certified Bad (squiblydoo) squiblydoo.blog · Research · 2023-05-12
• Exploring the Depths of SolarMarker's Multi-tiered Infrastructure (Recorded Future) Recorded Future · Research
• JuiceLedger Threat Actor Pivots from Fake Installers to Supply Chain Attacks (SentinelLabs) SentinelOne · Vendor report
• PyPI Phishing Campaign | JuiceLedger Threat Actor Pivots From Fake Apps to Supply Chain Attacks (SentinelLabs) SentinelOne · Vendor report
• Understanding the Status and Strategies of the Code Signing Abuse Ecosystem (NDSS 2026) ndss-symposium.org · Research
• This Week in Malware - A PyPI Phishing Follow-Up Plus 120 Packages (Sonatype) sonatype.com · Blog · 2022-09-02
• Phishing Attacks Against PyPi Users (The Hacker News) The Hacker News · News
• Inside the Underground Market for EV Code Signing Certificates (CyberInsider, on Intrinsec report) cyberinsider.com · News · 2024-08-01

More in malware

• Impostor Certificates: Threat Actors Impersonating Businesses to Obtain Code-Signing Certificates for SolarMarker and Other Malware
• SolarMarker: Actions-On-Target — On-Device Fraud via Custom VNC (Saturn) and Browser Data Theft
• Spamhaus Botnet Threat Update January to June 2025: 26% Rise in Botnet C&C Activity
• ScarfaceStealer: Sandbox-Aware Anti-Analysis and Blockchain-Based C2 Configuration (Electron/NSIS Loader)
• VOLTA-AUTODOXER: AI-Powered Windows Infostealer Ranks Stolen Data by Monetization Value