Cybersecurity researchers at ESET have spotted the new malware campaign when their systems started marking many files as suspicious. Since the flagged files were digitally signed using a legitimate D-Link Corporation code-signing certificate, it made the researchers more suspicious. The same certificate had been used to sign non-malicious D- Link software; therefore, the certificate was likely stolen. The compromised certificate was revoked on July 3, 2018, and the group behind the attack is BlackTech, a rather lesser-known cyber-espionage group that targets companies and organizations in Asia.”]
Source: https://hackercombat.com/stolen-d-link-certificates-spreads-backdoor-malware/