19 Trojanized IME Files Share One DigiCert Cert, Route C2 Through China's Largest CDN

Nineteen Windows executables masquerading as a Chinese input-method suite carried a single valid DigiCert code-signing certificate, producing clean sandbox verdicts despite detection by up to 54 of 79 AV engines. Malicious network traffic was routed through Wangsu ChinaNetCenter CDN infrastructure shared with Meituan, Dianping, and other major Chinese consumer platforms, making IP-layer blocking operationally costly.