T1588.004: Digital Certificates
Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.
Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust (i.e. Install Root Certificate). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.[1] Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.
Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.[2]
After obtaining a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.
Analyst context for executives and security teams
Digital Certificates is a resource-development behavior where adversaries obtain SSL/TLS certificates before or during targeting to make malicious infrastructure look trustworthy. For leaders, the risk is not just encryption; it is that normal trust signals such as HTTPS, valid certificates, and familiar-looking domains can reduce user suspicion and weaken network triage if teams treat “valid TLS” as benign.
Executive priority
Prioritize this where business operations depend on trusted web, DNS, identity, cloud, or third-party connectivity. The decision question is whether the organization can prove ownership of its legitimate certificate footprint, detect suspicious certificate use around its brands and domains, and investigate encrypted infrastructure without assuming that a valid certificate means safe traffic. ATT&CK relationships also connect this technique to multiple campaigns and groups, including activity described against critical infrastructure, government, research, and regional targets, making it relevant for risk-based threat intelligence and executive incident readiness.
Technical view
This is a PRE-platform, Resource Development sub-technique of Obtain Capabilities. MITRE provides no official detection text, but a related detection strategy, DET0848 Detection of Digital Certificates, is linked. SOC and detection teams should validate whether they can pivot on TLS certificate attributes such as issuer, subject, SANs, serial number, validity period, certificate fingerprint, reuse across infrastructure, and association with newly registered or hijacked domains. IR teams should also account for related ATT&CK behaviors referenced in the description, including encrypted C2 over web protocols, adversary-in-the-middle scenarios, root certificate installation, and later installation of certificates on adversary-controlled infrastructure.
Likely telemetry
- TLS/SSL handshake and certificate metadata from network monitoring, proxy, firewall, or sensor data
- DNS and domain registration context for organization-owned, lookalike, newly registered, or hijacked domains
- Certificate inventory for legitimate organizational certificates, including issuer, SANs, expiration, and fingerprints
- Certificate authority and certificate management records for issuance, renewal, revocation, and account activity
- Endpoint or configuration evidence of trusted root or digital certificate installation when incident scope includes certificate trust changes
Detection direction
- Do not rely on the presence of HTTPS or a valid certificate as an allow signal; tune triage to inspect certificate reputation, age, reuse, and domain context.
- Establish a baseline of legitimate organizational certificates so suspicious issuance, unexpected SANs, or certificate use on unrecognized infrastructure can be investigated.
- Correlate certificate observations with DNS changes, domain registration activity, proxy/SNI data, and web protocol traffic to reduce false positives from legitimate free or automated certificate issuance.
- Use relationship-driven context carefully: ATT&CK links this behavior to several groups and campaigns, but local evidence is required before making attribution or incident severity claims.
- Validate visibility gaps for encrypted traffic metadata, third-party-hosted services, cloud front ends, and externally managed domains, since those gaps often determine whether this behavior is detectable.
Mitigation priorities
- Apply pre-compromise controls consistent with M1056 by reducing exposed trust and domain-management weaknesses before adversaries use them.
- Maintain an authoritative certificate and domain inventory, including business owner, expected issuer, renewal path, and revocation process.
- Harden certificate lifecycle management: protect private keys, restrict certificate authority account access, and monitor issuance or renewal activity.
- Strengthen registrar, DNS, and domain ownership controls to reduce opportunities for domain hijacking or fraudulent validation.
- Prepare incident response procedures for suspicious certificate discovery, including validation of ownership, revocation decisions, DNS review, and checks for root certificate installation when relevant.
Analyst notes and limits
The most valuable operational use of this ATT&CK object is as a trust-abuse planning indicator. It helps detection engineers and threat intelligence teams ask whether encrypted infrastructure, certificate issuance, and domain-control evidence are visible enough to support investigations. External references supplied by MITRE include examples of certificate authority compromise, free certificate acquisition, and certificate-based hunting research.
MITRE does not provide official detection analytics for this object, and the platform is PRE, so this is not a host-specific procedure. The supplied relationships show that named campaigns and groups have used the technique, but they do not prove current exploitation, attribution, or exposure in any given environment. Local certificate inventory, DNS ownership records, and network telemetry are required for defensible conclusions.
Digital Certificates
Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.
Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust (i.e. Install Root Certificate). The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity. Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.[1] Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.
Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.[2]
After obtaining a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1588 | Obtain Capabilities | This object subtechnique of Obtain Capabilities. |
Groups, software, and campaigns
G0122: Silent Librarian
Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).[1][2][3]
G0032: Lazarus Group
Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]
North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]
G1041: Sea Turtle
Sea Turtle is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. Sea Turtle is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling Sea Turtle to spoof log in portals and other applications for credential collection.[1][2][3][4]
G0129: Mustang Panda
Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]
G1048: UNC3886
UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.[1][2]
G1014: LuminousMoth
LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organizations, including government entities, in Myanmar, the Philippines, Thailand, and other parts of Southeast Asia. Some security researchers have concluded there is a connection between LuminousMoth and Mustang Panda based on similar targeting and TTPs, as well as network infrastructure overlaps.[1][2]
G0098: BlackTech
BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.[1][2][3]
C0043: Indian Critical Infrastructure Intrusions
Indian Critical Infrastructure Intrusions is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly RedEcho and Threat Activity Group 38 (TAG38). The intrusions appear focused on IT system breach in Indian electric utility entities and logistics firms, as well as potentially managed service providers operating within India. Although focused on OT-operating entities, there is no evidence this campaign was able to progress beyond IT breach and information gathering to OT environment access.[1][2]
C0006: Operation Honeybee
Operation Honeybee was a campaign that targeted humanitarian aid and inter-Korean affairs organizations from at least late 2017 through early 2018. Operation Honeybee initially targeted South Korea, but expanded to include Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada. Security researchers assessed the threat actors were likely Korean speakers based on metadata used in both lure documents and executables, and named the campaign "Honeybee" after the author name discovered in malicious Word documents.[1]
C0047: RedDelta Modified PlugX Infection Chain Operations
RedDelta Modified PlugX Infection Chain Operations was executed by Mustang Panda from mid-2023 through the end of 2024 against multiple entities in East and Southeast Asia. RedDelta Modified PlugX Infection Chain Operations involved phishing to deliver malicious files or links to users prompting follow-on installer downloads to load PlugX on victim machines in a persistent state.[1]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 3f24c532a5e2… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
DiginotarCompromise
Fisher, D. (2012, October 31). Final Report on DigiNotar Hack Shows Total Compromise of CA Servers. Retrieved March 6, 2017.
Open source URL -
[2]
Let's Encrypt FAQ
Let's Encrypt. (2020, April 23). Let's Encrypt FAQ. Retrieved October 15, 2020.
Open source URL -
[3]
Recorded Future Beacon Certificates
Insikt Group. (2019, June 18). A Multi-Method Approach to Identifying Rogue Cobalt Strike Servers. Retrieved September 16, 2024.
Open source URL -
[4]
Splunk Kovar Certificates 2017
Kovar, R. (2017, December 11). Tall Tales of Hunting with TLS/SSL Certificates. Retrieved October 16, 2020.
Open source URL -
[5]
mitre-attack T1588.004Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.