Research

The following are research articles on the topic of certificates and certificate abuse.

General Articles

Published by Squiblydoo

• Certified Bad: 2023 Research on certificates being used across multiple malware families as seen through 50 certificates used by SolarMarker malware.
• Impostor Certs: 2024 Research on impersonated organizations as seen through certificates used by 100 certificates used SolarMarker malware.

Published by others

• 7 part blog by ReversingLabs
• Hunting Certified Imposters by Spence Hutchinson, from Sector 2024
• Code Signing Certificate Abuse in the Black Basta Chat Leaks and How to Fight Back - Expel Blog
• Certified OysterLoader: Tracking Rhysida Ransomware Gang Activity via Code Signing Certificates - Expel Blog
• The History of AppSuite: The Certs of the Baoloader Developer - Expel Blog

Academic Papers

• P-wave of malicious code signing
• Issued for Abuse: Measuring the Underground Trade in Code Signing Certificates

References to Cert Graveyard

Articles and resources that reference or feature the Cert Graveyard.

• (Don't) TrustConnect: It's a RAT in an RMM hat – February 19, 2026 publication on TrustConnect and it's use of a code-signing certificate to look legitimate
• RiskyBiz Newsletter for April 3rd – April 3, 2026 - RiskyBiz newsletter highlighting the official announcement of CertGraveyard
• Smoking out an affiliate – April 8, 2026 publication on the SmokedHam malware which regularly leverages code-signing certificates.