Not at all. A self-signed certificate using the CN of a website which the target device may already connect to (assuming it has KAV) is useful for stealth as i

Not at all. A self-signed certificate using the CN of a website which the target device may already connect to (assuming it has KAV) is useful for stealth as it allows your implant to blend into traffic more easily. However, attributing an attack based on the CN of an invalid TLS certificate would be very silly, as literally anyone can generate one (Instructions for generating the self-signed certs are actually right there in the source bundle).