Loading story…
A public project called CertGraveyard has expanded efforts to document abused code-signing certificates used to sign malware, building a shared record of certificate abuse and helping defenders trigger revocations with certificate authorities. The project’s creator said the initiative grew out of years of reporting malicious certificates tied to malware such as SolarMarker, and has helped report more than 2,000 certificates, later growing to roughly 2,400 entries in the database. Supporting tooling includes certReport, which automates abuse reports from malware hashes using sources such as VirusTotal and MalwareBazaar, plus an API, downloadable datasets, feeds, hunting queries, and integrations with platforms including MalwareBazaar, UnpacMe, Malcat, MagicSword.io, and WDAC enforcement workflows.
The database reflects a broader pattern in which threat actors repeatedly obtain or abuse valid Authenticode certificates to make malware appear trustworthy, reduce Windows warnings, and sustain delivery campaigns. Prior reporting cited SolarMarker cycling through impostor-issued certificates, FakeBat distributing signed MSI and MSIX installers, Netbounce using valid certificates and fake software branding, Dark Caracal signing Bandook variants with legitimate certificates, and Operation Red Signature abusing a stolen vendor certificate in a supply-chain intrusion. CertGraveyard’s operator said certificate authorities often act on external reports within hours, making revocation a practical disruption measure, though the project has also faced operational pressure including a major DDoS attack while handling heavy daily lookup and download volumes from defenders and malware-analysis integrations.
See real exploitation activity before you spend the cycle.
28 events from the most recent confirmed update back to the earliest known activity.
Sekoia's July 2026 report detailed FakeBat distribution clusters, signed MSI and MSIX delivery, and command-and-control evolution from August 2023 through June 2024 across more than 130 domains.
The June 2026 post said Cert Graveyard had documented 2,400 unique certificates and described defender use cases, API access, downloadable feeds, and heavy usage statistics including tens of thousands of daily lookups.
The April 2026 post described CertGraveyard's purpose, reporting workflows, integrations, and partnerships, and stated the project had already helped report more than 2,000 abused certificates across many malware families.
SecurityAura published Microsoft Defender for Endpoint hunting and detection queries that compare endpoint certificate telemetry against the Cert Graveyard/CertReport dataset to identify suspicious signed EXE, DLL, MSI, and MSIX files. The guidance distinguishes exact certificate-serial matches from signer-only matches and recommends serial matches for high-confidence detections.
The Cert Graveyard author said the service experienced a DDoS attack in May 2025 that generated 85.51 million requests, with 82.9 million mitigated but 2.45 million still causing about 400 GB of transfer in minutes.
Squiblydoo said CertGraveyard was officially launched in January 2025 as a public project to document abused code-signing certificates used to sign malware and support revocation reporting.
The 'Quick abuse reports with certReport' post introduced certReport as a tool to automate creation of certificate abuse and revocation reports for signed malware using VirusTotal or MalwareBazaar data.
As of June 2024, Sekoia identified more than 250 websites containing FakeBat fake-browser-update code via PublicWWW and more than 120 allegedly compromised sites via FOFA.
Sekoia documented an infection chain on May 30, 2024 in which the typosquatted AnyDesk site amydlesk[.]com redirected users to download a malicious AnyDesk-x86.msix installer from monkeybeta[.]com.
On May 15, 2024, Sekoia uncovered a FakeBat campaign targeting the web3 community through a fake chat application branded as getmess[.]io and promoted via compromised social accounts.
In 'Impostor Certificates,' the author said 100 certificates were known to have been abused to sign SolarMarker malware and described a three-year pattern of repeated certificate fraud and replacement.
Sekoia reported that from late March to June 2024, FakeBat used /profile/, /profile1/, and later /buy/ endpoints on infrastructure hosted by Host Sailor Ltd.
According to Squiblydoo, the SolarMarker actor paused development and new infections from January 2024 until March 2024.
Sekoia said that since January 2024, FakeBat malvertising campaigns have used Google Ads and typosquatted landing pages impersonating legitimate software download sites.
Squiblydoo said that between September 2023 and January 2024, the SolarMarker actor signed and deployed malware multiple times each week instead of its usual weekly cadence.
Sekoia reported that in September 2023, FakeBat operators started advertising MSIX builds and valid code-signing certificates to help customers bypass Microsoft SmartScreen.
In 'Certified Bad,' the researcher documented and reported 50 Authenticode certificates for revocation after studying two years of SolarMarker certificate abuse and identifying collisions across 14 malware families.
Squiblydoo said the certificate tied to JuiceLedger, IcedID, and SolarMarker abuse remained active after reporting and was ultimately revoked on January 25, 2023.
Sekoia reported that the threat actor Eugenfest, also known as Payk_34, had been selling FakeBat as a Loader-as-a-Service offering on the Exploit forum since at least December 2022.
A certificate later discussed in Squiblydoo's collision analysis was reported by SentinelLabs as being abused by JuiceLedger on September 1, 2022, but it remained valid afterward.
Symantec said the Billbug campaign had been ongoing since at least March 2022, targeting a digital certificate authority as well as government and defense agencies in multiple Asian countries.
FortiGuard Labs received an email on February 12 requesting that Packity Networks software be whitelisted, then investigated the linked installer and identified a new threat cluster it named Netbounce.
The CertGraveyard author said they began concentrating on code-signing abuse in 2021 while trying to improve detections for SolarMarker, after observing the malware was signed with a code-signing certificate.
Malware Hunter Team discovered new Dark Caracal-associated Bandook samples in November 2019, and the samples were signed with legitimate Certum-issued Windows code-signing certificates.
A compromised remote support software update server began selectively delivering a malicious update containing 9002 RAT to targeted South Korean organizations. Update logs placed the start of the malicious process at around 13:35 on July 18, 2018.
Researchers inferred that the specific 9002 RAT activity associated with Operation Red Signature lasted roughly from July 18 to July 31, 2018, during which additional tools such as PlugX, Mimikatz, and an IIS exploit were delivered.
Trend Micro reported that researchers found a ShiftDoor malware sample signed with the stolen certificate on April 8, 2018, indicating the certificate may have been compromised as early as that month.
A GitHub project named certgraveyard_yara was published to automatically generate YARA detection rules from the CertGraveyard compromised certificate database. The tool downloads CertGraveyard CSV data, generates and validates per-certificate rules, and packages combined rulesets for release automation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 498 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
18 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceblog.sekoia.io
Open sourcegithub.com
Open sourcesquiblydoo.blog
Open sourceblog.trendmicro.com
Open sourceattack.mitre.org
Open sourceunpac.me
Open sourcecertgraveyard.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DigiCert disclosed a breach in which a threat actor socially engineered its support team with a malicious ZIP file disguised as a customer screenshot, compromising two analyst workstations and gaining access to initialization codes for previously approved but undelivered EV code-signing certificate orders. The attacker used that access to obtain legitimate trusted code-signing certificates, and DigiCert revoked 60 certificates in response, including 27 directly linked to the intrusion. Reporting indicates 11 of those certificates were already used in the wild to sign **Zhong Stealer** malware, while a misconfigured CrowdStrike EDR agent on one compromised machine helped the attacker remain undetected for nearly two weeks. The incident unfolded alongside a separate trust-related disruption affecting DigiCert certificates on Windows systems: a faulty Microsoft Defender signature update released around April 30 falsely detected the legitimate **DigiCert Assured ID Root CA** and **DigiCert Trusted Root G4** certificates as `Trojan:Win32/Cerdigent.A!dha`. On affected hosts, Defender quarantined registry entries from the Windows trust store, raising the risk of SSL/TLS validation failures, broken code-signing verification, browser warnings, and enterprise application outages. Microsoft acknowledged the false positives and issued corrected definitions, with version `.430` cited as restoring the removed certificates automatically, while DigiCert tightened controls by enforcing MFA on administrative workflows, restricting access to initialization codes, limiting attachment types in support channels, and improving logging.
Jul 20, 2026
Breakglass Intelligence identified several active malware delivery operations using signed installers, compromised websites, and live command-and-control infrastructure to distribute loaders, stealers, and remote access tools. One campaign used the newly registered domain `maybedontbanplease[.]com` as CastleLoader C2 on 3NT Solutions LLP infrastructure, with a large NSIS installer embedding Python 3.14, AES-encrypted payloads, and in-memory shellcode execution via `pythonw.exe`; the installer was signed with an EV certificate issued to the likely fictitious entity **SERPENTINE SOLAR LIMITED**. The activity was attributed with medium-high confidence to **GrayBravo** and linked to delivery of **LummaC2, StealC, RedLine, Rhadamanthys, DeerStealer, NetSupport RAT,** and **SectopRAT**, with targeting that included U.S. government, critical infrastructure, IT, and logistics organizations. A separate operation distributed a trojanized `MSTeamsSetup.exe` that installed a weaponized **RustDesk** client and communicated with `mon.systemautoupdater[.]com` on EvoXT infrastructure, while presenting a TLS certificate for `calipology[.]com`, tying the activity to the **GeorgeGinx/Striker** operator. In another live campaign, attackers used the compromised Syrian web development site `allsydevs[.]com` to host an obfuscated .NET loader masquerading as a WordPress image and connected victims to `172[.]93[.]167[.]12:4263` over HTTPS using a self-signed certificate with the fake common name **Mesh Data**; at least six related samples were linked to the same C2, with lure names suggesting targeting of Middle Eastern construction and export firms. Together, the investigations show financially motivated actors expanding malware distribution through fraudulent code-signing, trojanized business software, and hijacked web infrastructure.
Jun 29, 2026
Researchers reported that the **BlankGrabber** information stealer is being delivered through a multi-stage infection chain disguised as a certificate installation process. In the analyzed campaign, a sample hosted on Gofile.io abused `certutil.exe` to decode non-certificate data and launch a Rust-based stager, which performed anti-sandbox checks before dropping both the Python-based BlankGrabber stealer and the **XWorm** remote access trojan. The malware has been spread through phishing lures, fake cracked software, Discord-shared archives, and fraudulent GitHub repositories, showing a broader effort to target everyday users through familiar distribution channels. Once installed, BlankGrabber steals browser credentials, session tokens, saved passwords, clipboard data, Wi‑Fi passwords, cryptocurrency wallet information, screenshots, and webcam captures, while the accompanying XWorm RAT expands attacker access. Analysts said the chain uses layered obfuscation, PyInstaller packaging, `AES-GCM` decryption, PowerShell commands to tamper with Microsoft Defender, hosts file modification, and startup-folder persistence to evade detection and maintain control. Defenders were urged to watch for `certutil.exe` decoding unusual content, suspicious WinRAR execution, Defender-disabling PowerShell activity, and anomalous DNS traffic to Telegram APIs or file-sharing services.
Jun 29, 2026