https://www.trellix.com/blogs/research/new-stealer-uses-invalid-cert-to-compromise-systems/