# Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.)

> Research presented at SLEUTHCON tracked 50 code-signing certificates over two years and 698 signed files, finding 14 distinct malware families signed with the same certificates. Impostors obtain EV certificates through identity fraud, build 'Proof of Value' by signing benign programs, and sell signing services to multiple threat actors.

- **Published:** 2026-11-03T05:30:13Z
- **Last reviewed:** 2026-11-03T05:30:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5122
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5122.png
- **ID:** TL-2026-5122
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

In the research 'Certified Bad' (squiblydoo, presented at SLEUTHCON, published 2023-05-12), the author tracked 50 Authenticode code-signing certificates over more than two years, analyzing 698 signed files on VirusTotal. The certificates, marketed by Certum (Certum.EU / Certum.PL) as Extended Validation (EV) certificates conferring browser and SmartScreen trust benefits, were all assessed to have been issued to impostors rather than stolen: no legitimate files from the organizations named on the certificates were found among the 698 binaries.

EV issuance involves three stages: government-database checks that the company exists, domain control validation, and a robotic verification call to a phone number, after which a two-factor hardware/virtual token is issued for signing. The impostors defeat this process by impersonating legitimate organizations. After issuance, the operator builds a 'Proof of Value' by signing a benign 'Hello World' program and uploading it to VirusTotal, which demonstrates the certificate's capability to prospective buyers. The operator then sells signing services to multiple threat actors, so the same certificate signs unrelated malware families and creates common threads between otherwise competing actors.

Fourteen distinct families were identified as sharing certificates, including SolarMarker, ZLoader, IcedID, Chromeloader (412 samples, mostly impostor testing uploads), CobaltStrike, Qakbot, NetSupportRAT, RemcosRAT, BazaarLoader, JuiceLedger, Neshta, lock-screen malware and an unknown RAT. Most certificates were abused within 50 days of issuance, many within the first day or week, and some up to 600 days after issuance; one example certificate remained in abuse for more than 455 days before revocation. In one example timeline, the Hello World proof was uploaded on day 0, lock-screen malware was signed on day 31, and a SolarMarker binary was signed on day 53.

Revocation was slow. A certificate tied to the JuiceLedger activity, reported by SentinelLabs on 2022-09-01, kept being used to sign malware including IcedID and SolarMarker until it was revoked on 2023-01-25, a gap of roughly 147 days during which multiple actors could use it. SentinelLabs/Checkmarx research from September 2022 describes JuiceLedger evolving from fraudulent Python installers carrying the .NET 'JuiceStealer' infostealer (early 2022) to PyPI phishing and supply-chain poisoning (August 2022). Recorded Future separately documents SolarMarker (aka Yellow Cockatoo, Jupyter Infostealer) using Authenticode certificates and oversized compressed archives to evade antivirus, with a multi-tiered C2 infrastructure of primary and secondary clusters, rapid rebuilds after compromise, and targeting of education, healthcare, government, hospitality and SMEs. Related industry research (Intrinsec, August 2024) places EV certificates at $2,000-$6,500 on underground forums, and an NDSS 2026 study counted 43,286 abused certificates in 3,216,113 signed malicious PEs across 46 CAs, including 3,484 polymorphic certificate clusters used to circumvent revocation. Severity is an analyst estimate; no CVE or CVSS applies.

## MITRE ATT&CK

- T1588.003 Obtain Capabilities: Code Signing Certificates
- T1553.002 Subvert Trust Controls: Code Signing
- T1684.001 Impersonation
- T1027.001 Obfuscated Files or Information: Binary Padding
- T1204.002 User Execution: Malicious File
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Shared Impostor EV Certificate: One Signer Vouching for Unrelated Binaries in User-Writable Paths (SolarMarker et al.) — Exploitation Phase** (`TL-2026-5122-SPL-001`)

Detects the signer-reuse pattern from the 'Certified Bad' research (TL-2026-5122): a single valid Authenticode signer that signs several distinct hashes and products loaded from Downloads, AppData, Temp or ProgramData on a small number of hosts. Impostor-obtained EV certificates are sold as signing-as-a-service, so the same subject signs SolarMarker, ZLoader, IcedID, Qakbot, Cobalt Strike and other unrelated families. A valid signature alone is not a trust signal; this rule keys on signer collisions instead. SPL is the authoritative flavor (Sysmon EventCode 7 exposes Signature/SignatureStatus); KQL uses DeviceFileCertificateInfo; Sigma uses a value_count correlation over an image_load base rule.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1553.002, T1588.003, T1204.002
- **Data sources:** sysmon, splunk:index=sysmon, DeviceFileCertificateInfo, DeviceProcessEvents
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=7 Signed=true SignatureStatus=Valid earliest=-7d (ImageLoaded="*Downloads*" OR ImageLoaded="*AppData*" OR ImageLoaded="*Temp*" OR ImageLoaded="*ProgramData*") NOT Signature IN ("Microsoft Corporation","Microsoft Windows") ```TL-2026-5122 shared impostor EV certificate: one Authenticode signer vouching for several unrelated products and hashes is the reuse pattern seen across SolarMarker, ZLoader, IcedID, Qakbot and Cobalt Strike samples``` | rex field=Hashes "SHA256=(?<sha256>[A-Fa-f0-9]{64})" | stats dc(sha256) AS distinct_hashes dc(Product) AS distinct_products dc(Company) AS distinct_companies dc(host) AS host_count values(OriginalFileName) AS original_names values(ImageLoaded) AS sample_paths min(_time) AS first_seen max(_time) AS last_seen BY Signature | where distinct_hashes>=3 AND distinct_products>=2 AND host_count<=10 | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | table Signature distinct_hashes distinct_products distinct_companies host_count original_names sample_paths first_seen last_seen
````

### Microsoft KQL

```kql
// TL-2026-5122: one Authenticode signer vouching for several unrelated products (shared impostor EV certificate)
let lookback = 7d;
let signers = DeviceFileCertificateInfo
| where Timestamp > ago(lookback)
| where IsSigned == true and IsTrusted == true
| where Signer !in~ ("Microsoft Corporation", "Microsoft Windows")
| summarize arg_max(Timestamp, Signer, Issuer, CertificateSerialNumber) by SHA1;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FolderPath has_any ("Downloads", "AppData", "Temp", "ProgramData")
| join kind=inner signers on SHA1
| summarize DistinctHashes = dcount(SHA256), DistinctProducts = dcount(ProcessVersionInfoProductName), DistinctCompanies = dcount(ProcessVersionInfoCompanyName), DeviceCount = dcount(DeviceId), SampleFiles = make_set(FileName, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by Signer, Issuer, CertificateSerialNumber
| where DistinctHashes >= 3 and DistinctProducts >= 2 and DeviceCount <= 10
| order by DistinctHashes desc
```

### Sigma

```yaml
title: Valid-Signed Image Load From User-Writable Path (Shared EV Certificate Signer Base)
name: tl_2026_5122_signed_userpath_imageload
id: b1e0c7a4-5d2f-4c8e-9a31-7f6d2e8c1a01
status: experimental
description: Base rule for TL-2026-5122. Image loaded from a user-writable path with a valid Authenticode signature from a non-Microsoft signer. The correlation rule below fires when one signer vouches for several distinct hashes, the shared impostor EV certificate pattern seen with SolarMarker, IcedID and ZLoader.
references:
  - https://squiblydoo.blog/2023/05/12/certified-bad/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.defense-evasion
  - attack.t1553.002
  - attack.execution
  - attack.t1204.002
  - attack.resource-development
  - attack.t1588.003
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Signed: 'true'
    SignatureStatus: 'Valid'
    ImageLoaded|contains:
      - '\Downloads\'
      - '\AppData\'
      - '\Temp\'
      - '\ProgramData\'
  filter_microsoft:
    Signature:
      - 'Microsoft Corporation'
      - 'Microsoft Windows'
  condition: selection and not filter_microsoft
falsepositives:
  - Third-party software updaters that stage signed binaries in AppData or Temp
level: informational
---
title: Shared Authenticode Signer Across Multiple Distinct Binaries (Certified Bad)
id: 3c9a5e72-1b4d-4f60-8e27-a5d9c4b30f02
status: experimental
description: Fires when one Authenticode signer is seen on three or more distinct file hashes loaded from user-writable paths within seven days, the signer-sharing pattern across malware families described in TL-2026-5122.
references:
  - https://squiblydoo.blog/2023/05/12/certified-bad/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.defense-evasion
  - attack.t1553.002
  - attack.execution
  - attack.t1204.002
  - attack.resource-development
  - attack.t1588.003
correlation:
  type: value_count
  rules:
    - tl_2026_5122_signed_userpath_imageload
  group-by:
    - Signature
  timespan: 7d
  condition:
    gte: 3
    field: Hashes
falsepositives:
  - Small ISVs that sign several in-house tools with one certificate
level: high
```

**Known false positives:**

- Legitimate ISVs that sign several distinct products with one corporate certificate and distribute them through user-writable installer paths
- Software updaters (Electron apps, game launchers) that stage signed binaries in AppData or Temp

**Tuning notes:** Raise distinct_hashes or distinct_products for noisy estates, widen host_count if your fleet is large, and add an allow-list of known ISV signers (Google, Zoom, Adobe, JetBrains). Enrich hits with certificate issuer (Certum EV) and certificate age, since most abused certificates were used within 50 days of issuance. Review the signer thumbprint against threat-intel before blocking.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Valid-Signed Executable With Publisher Metadata Mismatch in User-Writable Path (Impostor EV Certificate) — Exploitation Phase (locked: unlock with TL Creds)
- Fake Python Installer Not Published by Python Software Foundation (JuiceLedger / JuiceStealer Lure) — Post-Exploitation (locked: unlock with TL Creds)
- Beacon-Like Periodic Web Connections From User-Writable Path Executables (Cobalt Strike / Remcos / NetSupport / SolarMarker Style C2) — C2 (locked: unlock with TL Creds)
- Execution or Load of Known Impostor-EV-Signed Samples (SolarMarker, JuiceLedger, Lock-Screen, Unknown RAT, Proof-of-Value) — Exploitation Phase (locked: unlock with TL Creds)
- Remcos RAT Registry Configuration Key Creation — Post-Exploitation (locked: unlock with TL Creds)
- NetSupport RAT Gateway Beacon (NetSupport Manager User-Agent and fakeurl.htm POST) — C2 (locked: unlock with TL Creds)
- NetSupport RAT Client (client32.exe) Executed Outside Vendor Install Directory — Post-Exploitation (locked: unlock with TL Creds)
- Network Contact With Community-Observed Sibling Infrastructure (Remcos / NetSupport / Cobalt Strike OSINT) — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- File hash: `38f3f04bb595286e49939a02dbc369d49516b421e2828557cba7f286ca85bf70`
- File hash: `0f069b41245d76dd228b512cc1f3bac12e656bcd1b5415c30048bfdba2f5e208`
- File hash: `4630b0be7226c9003d34717f7eb092eb51242bd9723d118b4b106c9727503a7b`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Certified Bad (squiblydoo)](https://squiblydoo.blog/2023/05/12/certified-bad/)
- [Exploring the Depths of SolarMarker's Multi-tiered Infrastructure (Recorded Future)](https://www.recordedfuture.com/research/exploring-the-depths-of-solarmarkers-multi-tiered-infrastructure)
- [JuiceLedger Threat Actor Pivots from Fake Installers to Supply Chain Attacks (SentinelLabs)](https://www.sentinelone.com/labs/juiceledger-threat-actor-pivots-from-fake-installers-to-supply-chain-attacks/)
- [PyPI Phishing Campaign | JuiceLedger Threat Actor Pivots From Fake Apps to Supply Chain Attacks (SentinelLabs)](https://sentinelone.com/labs/pypi-phishing-campaign-juiceledger-threat-actor-pivots-from-fake-apps-to-supply-chain-attacks)
- [Phishing Attacks Against PyPi Users (The Hacker News)](https://thehackernews.com/2022/09/juiceledger-hackers-behind-recent.html)
- [This Week in Malware - A PyPI Phishing Follow-Up Plus 120 Packages (Sonatype)](https://www.sonatype.com/blog/this-week-in-malware-sept-2-22)
- [Understanding the Status and Strategies of the Code Signing Abuse Ecosystem (NDSS 2026)](https://www.ndss-symposium.org/ndss-paper/understanding-the-status-and-strategies-of-the-code-signing-abuse-ecosystem/)
- [Inside the Underground Market for EV Code Signing Certificates (CyberInsider, on Intrinsec report)](https://cyberinsider.com/inside-the-underground-market-for-ev-code-signing-certificates/)
- [CA/Browser Forum EV Code Signing Guidelines](https://cabforum.org/uploads/EV-Code-Signing-v.1.5.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5122