CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines, daily updates. Fast, privacy‑respecting. No ads, no tracking.

Iranian APT UNC1549 uses SSL.com certificates to sign malware

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

The Iranian state-sponsored cyber espionage group UNC1549 (also known as Subtle Snail, Nimbus Manticore, Smoke Sandstorm, and Tortoiseshell) has been using SSL.com digital certificates to sign malware, making it harder to detect. This activity has been observed targeting European organizations with new backdoor and infostealer binaries. The use of valid digital certificates has significantly reduced the detection rates of these malware strains by antimalware and threat detection platforms. The certificates were issued to seemingly fraudulent or impersonated companies, including Insight Digital B.V. in the Netherlands and RGC Digital AB and Sevenfeet Software AB in Sweden. These certificates have been used since at least May 2025, and some remain valid. The misuse of SSL.com certificates raises concerns about the certificate authority's verification processes and the broader risks to networks.

Timeline

  1. 26.09.2025 18:28 1 articles · 3d ago

    UNC1549 uses SSL.com certificates to sign malware

    The Iranian APT UNC1549 has been using SSL.com certificates to sign malware, making it harder to detect. The certificates were issued to seemingly fraudulent or impersonated companies and have been used since at least May 2025. This activity has been observed targeting European organizations with new backdoor and infostealer binaries.

    Show sources
    Open in new tab

Information Snippets