Activity timeline
T1587.003 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1587.003 Digital Certificates is catalogued by MITRE ATT&CK under the Resource Development tactic in the Enterprise matrix, as a sub-technique of T1587 Develop Capabilities. Threadlinqs maps 10 of 3214 tracked threats (0.3%) to it; by severity that is 4 critical, 4 high, 2 medium.
Threats that use T1587.003 most often also use T1036.005 Match Legitimate Resource Name or Location (7 threats), T1190 Exploit Public-Facing Application (6 threats), T1005 Data from Local System (5 threats), T1057 Process Discovery (4 threats), T1105 Ingress Tool Transfer (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
9 tracked threat actors appear in the threats that use T1587.003; the most frequent are APT36 (1), APT38 (1), Gamaredon Group (1), SideCopy (1), TA4922 (1).
Threat actors using it
Tracked threats
10 tracked threats use T1587.003.
- AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution: SFuck/BFuck Check-ins, XOR, ChaCha20 and TLS…high
- CVE-2026-91403: Critical Oracle Java SE and GraalVM JSSE Flaw Enables Unauthenticated Remote Attacks (CVSS…critical
- CVE-2026-111943: Go Blocks Compromised eMudhra CA Keys After Certificate Authority Incidenthigh
- CISA Adds Four Actively Exploited KEVs: Check Point Gateway/Management RCE Flaws, Arista VeloCloud…critical
- Check Point Security Gateway VPN Pre-Auth RCE (CVE-2026-85102) and Management Path Traversal Zero-Day…critical
- Dutch NCSC Warns of Critical Check Point VPN Flaws (CVE-2026-85102, CVE-2026-85103) — Exploitation Expected…critical
- PATCHCORD, SHEETCORD & HACKERAI C2 Agent: New Malware Cluster Targets Afghan Telecom and South Asian…high
- Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiledhigh
- 700+ Typosquatted/Lookalike Domains Targeting Oil and Gas Brands (Chevron, ExxonMobil, Shell) for Phishing…medium
- Passive DNS Pivoting Uncovers 122 New ACTINIUM (Gamaredon) Infrastructure Domainsmedium
Detection coverage
Threadlinqs maintains 14 detection rules mapped to T1587.003 (SPL 3, KQL 5, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1587 Develop Capabilities — 403 tracked threats at the technique level.