Suckfly: Revealing the secret life of your code signing certificates | Symantec Connect Community

Symantec details the Suckfly APT group's use of stolen code-signing certificates to sign malware and tools, enabling targeted cyberespionage across industries; it traces certificate theft, distribution, and use, describes a custom backdoor (Nidiran) delivered through an OLE vulnerability exploit, and calls for strong certificate protection and revocation practices.