Since June 2019, the actor has issued more than 50 SSL certificates that were used on WatchGuard C&Cs on various TCP ports (as far as we are aware, the following TCP ports were used: 636, 989, 990, 994, 995, 3269, and 8443).