# T1587.003 Digital Certificates > As of 2026-10-25, T1587.003 (Digital Certificates) appears in 10 tracked threats, first reported 2026-07-18 and most recently 2026-10-24, with linked actors including APT36, APT38, Gamaredon Group; it most often appears alongside T1036.005 (Match Legitimate Resource Name or Location). - **Tracked threats:** 10 (4 critical, 4 high, 2 medium) - **First seen:** 2026-07-18 - **Last seen:** 2026-10-24 - **Threat actors:** 9 - **Detection rules:** 14 (counts only; Blue tier and above) ## Key facts - **ID:** T1587.003 - **Framework:** MITRE ATT&CK - **Tactics:** Resource Development - **Matrix:** Enterprise - **Parent:** T1587 - **Data as of:** 2026-10-25 - **MITRE:** https://attack.mitre.org/techniques/T1587/003/ ## Activity timeline T1587.003 first appeared in tracked threats on 2026-07-18 and was most recently reported on 2026-10-24. The busiest month was 2026-07 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1587.003 Digital Certificates is catalogued by MITRE ATT&CK under the Resource Development tactic in the Enterprise matrix, as a sub-technique of [T1587 Develop Capabilities](https://intel.threadlinqs.com/technique/T1587). Threadlinqs maps 10 of 3214 tracked threats (0.3%) to it; by severity that is 4 critical, 4 high, 2 medium. Threats that use T1587.003 most often also use [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (7 threats), [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (6 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (5 threats), [T1057 Process Discovery](https://intel.threadlinqs.com/technique/T1057) (4 threats), [T1105 Ingress Tool Transfer](https://intel.threadlinqs.com/technique/T1105) (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 9 tracked threat actors appear in the threats that use T1587.003; the most frequent are [APT36](https://intel.threadlinqs.com/actor/APT36) (1), [APT38](https://intel.threadlinqs.com/actor/APT38) (1), [Gamaredon Group](https://intel.threadlinqs.com/actor/Gamaredon%20Group) (1), [SideCopy](https://intel.threadlinqs.com/actor/SideCopy) (1), [TA4922](https://intel.threadlinqs.com/actor/TA4922) (1). ## Threat actors using it - [APT36](https://intel.threadlinqs.com/actor/APT36) — 1 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 1 - [Gamaredon Group](https://intel.threadlinqs.com/actor/Gamaredon%20Group) — 1 - [SideCopy](https://intel.threadlinqs.com/actor/SideCopy) — 1 - [TA4922](https://intel.threadlinqs.com/actor/TA4922) — 1 - [Transparent Tribe](https://intel.threadlinqs.com/actor/Transparent%20Tribe) — 1 - [UNC6508](https://intel.threadlinqs.com/actor/UNC6508) — 1 - [Void Arachne](https://intel.threadlinqs.com/actor/Void%20Arachne) — 1 - [Volt Typhoon - G1017](https://intel.threadlinqs.com/actor/Volt%20Typhoon%20-%20G1017) — 1 ## Tracked threats 10 tracked threats use T1587.003. - [AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution: SFuck/BFuck Check-ins, XOR, ChaCha20 and TLS…](https://intel.threadlinqs.com/threat/TL-2026-4419) — high — 2026-10-24 - [CVE-2026-91403: Critical Oracle Java SE and GraalVM JSSE Flaw Enables Unauthenticated Remote Attacks (CVSS…](https://intel.threadlinqs.com/threat/TL-2026-4138) — critical — 2026-10-22 - [CVE-2026-111943: Go Blocks Compromised eMudhra CA Keys After Certificate Authority Incident](https://intel.threadlinqs.com/threat/TL-2026-4034) — high — 2026-10-21 - [CISA Adds Four Actively Exploited KEVs: Check Point Gateway/Management RCE Flaws, Arista VeloCloud…](https://intel.threadlinqs.com/threat/TL-2026-2678) — critical — 2026-09-26 - [Check Point Security Gateway VPN Pre-Auth RCE (CVE-2026-85102) and Management Path Traversal Zero-Day…](https://intel.threadlinqs.com/threat/TL-2026-2677) — critical — 2026-09-26 - [Dutch NCSC Warns of Critical Check Point VPN Flaws (CVE-2026-85102, CVE-2026-85103) — Exploitation Expected…](https://intel.threadlinqs.com/threat/TL-2026-2463) — critical — 2026-09-12 - [PATCHCORD, SHEETCORD & HACKERAI C2 Agent: New Malware Cluster Targets Afghan Telecom and South Asian…](https://intel.threadlinqs.com/threat/TL-2026-2006) — high — 2026-08-13 - [Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiled](https://intel.threadlinqs.com/threat/TL-2026-1721) — high — 2026-07-27 - [700+ Typosquatted/Lookalike Domains Targeting Oil and Gas Brands (Chevron, ExxonMobil, Shell) for Phishing…](https://intel.threadlinqs.com/threat/TL-2026-1519) — medium — 2026-07-19 - [Passive DNS Pivoting Uncovers 122 New ACTINIUM (Gamaredon) Infrastructure Domains](https://intel.threadlinqs.com/threat/TL-2026-1484) — medium — 2026-07-18 ## Related CVEs CVEs referenced by the tracked threats that use T1587.003, most frequent first. - [CVE-2026-85102](https://intel.threadlinqs.com/cve/CVE-2026-85102) - [CVE-2026-93616](https://intel.threadlinqs.com/cve/CVE-2026-93616) - [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684) - [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997) - [CVE-2023-38831](https://intel.threadlinqs.com/cve/CVE-2023-38831) - [CVE-2024-39717](https://intel.threadlinqs.com/cve/CVE-2024-39717) - [CVE-2024-6387](https://intel.threadlinqs.com/cve/CVE-2024-6387) - [CVE-2026-85103](https://intel.threadlinqs.com/cve/CVE-2026-85103) - [CVE-2026-93952](https://intel.threadlinqs.com/cve/CVE-2026-93952) - [CVE-2026-94127](https://intel.threadlinqs.com/cve/CVE-2026-94127) ## Detection coverage Threadlinqs maintains 14 detection rules mapped to T1587.003 (SPL 3, KQL 5, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only. 14 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1587 Develop Capabilities](https://intel.threadlinqs.com/technique/T1587) — 403 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1587.003 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)