Known malicious kithighother

ShadowPad-style self-signed certificate claiming a major brand (tripwire)

family: bluemoon-shadowpad-2026-09

Generalizing tripwire, not an IoC: ShadowPad C2 servers in this campaign present SELF-SIGNED TLS certificates whose subject organization impersonates a major brand. This catches infrastructure without a published indicator. Based on Proofpoint's "Once in a BlueMoon" report (2026-09).

Anchors

SMQL queryrun

cert_self_signed:true AND cert_org:"Google LLC"

Provenance

Added: 2026-09-12 10:36

Self-signed certificates usually carry placeholder organizations (Acme Co, Internet Widgits Pty Ltd, MyOrg) rather than brand names, so a self-signed certificate claiming a major brand is anomalous by construction. A forward-looking tripwire.

References:

https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit

Sightings (0)

No sightings recorded yet.