Research

The following are research articles on the topic of certificates and certificate abuse.

General Articles

Published by Squiblydoo

• Certified Bad: 2023 Research on certificates being used across multiple malware families as seen through 50 certificates used by SolarMarker malware.
• Impostor Certs: 2024 Research on impersonated organizations as seen through certificates used by 100 certificates used SolarMarker malware.

Published by others

• 7 part blog by ReversingLabs
• Hunting Certified Imposters by Spence Hutchinson, from Sector 2024

Academic Papers

• P-wave of malicious code signing
• Issued for Abuse: Measuring the Underground Trade in Code Signing Certificates