The backdoors were also similarly signed using the same stolen code-signing certificate from ‘HT Srl.’ C2 Infrastructure Cylance found that at least half of the infrastructure associated with The Deception Project appeared to be dark or at least unused.