which seemed to be selling its stolen digital certificates to other China-based hackers, according to one analysis by security firm Crowdstrike. "They may have been freelancers who joined a larger group thats now focused on espionage," says Michal Salat, the head of threat intelligence at Avast.