Research

The following are research articles on the topic of certificates and certificate abuse.

General Articles

Published by Squiblydoo

• Certified Bad: 2023 Research on certificates being used across multiple malware families as seen through 50 certificates used by SolarMarker malware.
• Impostor Certs: 2024 Research on impersonated organizations as seen through certificates used by 100 certificates used SolarMarker malware.

Published by others

• 7 part blog by ReversingLabs
• Hunting Certified Imposters by Spence Hutchinson, from Sector 2024
• Code Signing Certificate Abuse in the Black Basta Chat Leaks and How to Fight Back - Expel Blog
• Certified OysterLoader: Tracking Rhysida Ransomware Gang Activity via Code Signing Certificates - Expel Blog
• The History of AppSuite: The Certs of the Baoloader Developer - Expel Blog

Academic Papers

• P-wave of malicious code signing
• Issued for Abuse: Measuring the Underground Trade in Code Signing Certificates