Four Corporate Fronts, One Build Pipeline: 18-Month DigiCert Signing Spree

A single operator has obtained DigiCert G4 code-signing certificates under four distinct Chinese corporate identities and rotated them across a shared build pipeline to deliver adware, trojans, and remote access tooling through consumer software bundles. PE overlay abuse and active sandbox suppression have kept the campaign's detection profile in the gap between static and dynamic analysis pipelines for over eighteen months. The operation's three active certificates collectively provide signing runway through mid-2027 without requiring any new identity acquisition.