DarkPeony’s Trail: Certificate Patterns Point to Sustained Campaign Infrastructure

This analysis expands on previously reported DarkPeony infrastructure associated with PlugX: investigators identified multiple IPs, domains, and SSL certificate patterns (notably 'AES' in OU and CloudFlare origin certs) used to hide C2 and malware distribution. The report links a malicious 'Meeting Invitation.msc' sample to domains (e.g., vabercoach.com, loginge.com), lists IPs, ASNs and certificate hashes as network observables, and offers a JARM/subject CN query to help defenders hunt for related CloudFlare-origin certificates and emerging infrastructure.