Certified OysterLoader: Tracking Rhysida ransomware gang activity via code-signing certificates

Threat intel · 6 MIN READ · AARON WALTON · OCT 31, 2025 · TAGS: Malware

TL;DR

• There’s an ongoing malicious ad campaign delivering a malware called OysterLoader, previously known as Broomstick and CleanUpLoader
• The malware is an initial access tool (IAT) that gets onto devices to run a backdoor to gain access to the device and network
• The malware is being leveraged by the Rhysdia ransomware gang 

The Rhysida gang has been targeting enterprises for years now. First working as Vice Society in 2021, and then rebranding to Rhysida in 2023 [1, 2, 3]. While they may have rebranded to divert law enforcement, defenders don’t forget just because of changed names or time passed. 

We’re tracking Rhysida’s current campaign leveraging malicious advertisements to deliver OysterLoader malware (also known as Broomstick and CleanUpLoader). The first campaign ran from May to September 2024, and the current campaign has been running since June of this year. 

OysterLoader is, fundamentally, an initial access tool (IAT). Its sole function is to establish a foothold on a device so a second stage persistent backdoor can be dropped on the system and establish long-term access. Getting the first stage into a network is a common first step step in a larger network intrusion.

The delivery: malvertizing

The current infection chain is built on a highly successful malvertising model. Threat actors  buy Bing search engine advertisements to direct users to convincing-looking, but malicious landing pages. These search engine ads put links to the download right in front of potential victims. The most recent campaigns push ads for Microsoft Teams and impersonate the download pages. However, they’ve also cycled through other popular software such as PuTTy and Zoom.

Using ads for Teams and other products is an identical tactic to what was seen by the same actors in 2024. This technique is a clear indicator of the gang’s commitment to proven tactics, mimicking a highly effective campaign they executed previously.

OysterLoader: the foot in the door

To insure the first stage’s success, the actors do two things to achieve low detection rates:

1. They pack the malware
2. They use code-signing certificates

Packing is a technique used to compress, encrypt, or obfuscate the function of the software. In the case of Rhysida, their packing tool effectively hides the capabilities of the malware and results in a low static detection rate when the malware is first seen.

Code-signing certificates are standard for legitimate software. The Windows operating system uses code-signing as a measure of confidence that a file came from a valid source. The trust comes from the software publisher listed in the certificate going through a vetting process to get the code-signing certificate, but this system isn’t without its flaws. The Rhysida ransomware gang uses certificates to give their own malicious files a higher level of trust.  

Signing as signal

Due to their use of code-signing certificates, we gain an advantage in tracking and identifying new campaigns. The certificates they use regularly get revoked by the certificate’s issuer, so new instances of the malware with a valid certificate indicate a new run of the campaign. Expel actively reports these certificates to be revoked as we encounter them, and the revocations help operating systems, antivirus, and browsers better identify and mitigate the malware. 

On any given day the bad actors may use multiple certificates, but seeing their files with a new fresh certificate also helps us know they’re still active. These new certificates further indicate steady investment into their campaign.

CertCentral.org currently documents a total of 47 unique certificates used to sign OysterLoader across the 2024 and 2025 timeframes, underscoring the larger scale of this campaign.

Not all Rhysida’s eggs are in one basket

Though the main focus of this blog is OysterLoader, Rhysida’s activity isn’t limited to this one malware. During the current campaign, they’re also using the Latrodectus malware to get initial access to networks. We identified this when analyzing files for the purpose of building detection rules: we observed that our YARA rules developed to detect their packer also detected Latrodectus malware. This was further confirmed when we observed an instance where the same code-signing certificate was used to sign both malware.

In the majority of situations, Rhysida has smartly avoided using the same certificate across campaigns. However, this activity highlights their involvement with both campaigns.

In addition to this one certificate, the Rhysida ransomware gang are also one of the few cybercriminals leveraging Trusted Signing from Microsoft—Microsoft’s own service for issuing code-signing certificates—and they use these Trusted Signing certificates for both OysterLoader and the second stage dropped from Latrodectus.

Microsoft Trusted Signing

Microsoft Trusted Signing certificates were created with certain features to limit misuse, however, the Rhysida ransomware gang appear to have found ways around those restrictions. The certificates are issued with a 72-hour validity period. After that, the certificates expire and need to be renewed. This short period makes the standard process of purchasing and reselling certificates infeasible. However, the Rhysida ransomware gang—or a supplier of theirs—has identified a means to abuse Microsoft’s Trusted Signing system, allowing them to sign files at scale. Microsoft themselves report having revoked more than 200 certificates associated with the Rhysida ransomware gang and OysterLoader. The majority of these were revoked before they were actively abused to sign malware and deployed, though there is no sign of Rhysida ransomware stopping their use of Microsoft’s service.

Keeping track

This campaign is likely to continue and may change as a result of this blog and we plan to continue to monitor it and track it. Indicators associated with these campaigns are on GitHub here: https://github.com/expel-io/expel-intel/blob/main/2025/10/Rhysida_malware_indicators-01.csv