Counterfeit certificates sold online make digitally signed malware a snap (arstechnica.com)

So where are these certificates coming from? I don’t suppose the criminals have the CA keys.