(note: am currently employed by a kaspersky competitor, opinions my own) exactly. as far as i can tell, this cert was created to impersonate kaspersky to silly

(note: am currently employed by a kaspersky competitor, opinions my own) exactly. as far as i can tell, this cert was created to impersonate kaspersky to silly middle-boxes and wireshark-using admins, who might just look at the name in the cert and not check whether it was valid. it makes sense for a random endpoint to be contacting your AV vendor's infrastructure, so it's a reasonable way to hide. (other reasonable targets, like, say, windows update, might be disabled or managed by the enterprise) there doesn't seem to be any intent at all to impersonate kaspersky w.r.t. attribution of malicious actions. rather, it's an attempt to hide malware c2 traffic as legitimate av traffic. the narrative being pushed here seems to be an honestly transparent attempt at misinformation, borne out of... either a significant misunderstanding of the situation, or, as much as i hesitate to say it, intentional manipulation. wouldn't be surprised if some target happened to be using kaspersky, and this cert was created specifically for that. (also might point out that the original poster's account appears to entirely consist of submissions from their personal blog, which doesn't seem... great?)