Expired and Revoked Certs Anchor Active Malware Delivery Chain

A delivery chain distributing PremierOpinion adware components and a widely circulated bundler is abusing two broken code-signing certificates — one expired, one explicitly revoked — from DigiCert and Certum EV issuers simultaneously. All three malicious PE samples share sandbox-evasion logic that produces near-zero dynamic verdicts despite static detection rates of 44–48 out of 76 engines. CTX Team has tracked the cluster, tagged to the surtr malware family, since August 2025.