Diplomatic targets in Central Asia were infected by a firmware implant that exploits an unblocklisted certificate most admins never revoked.