Attackers Distributing Malware Under Guise of Security Certificate Updates

Approach is a twist to the old method of using fake software, browser updates, Kaspersky says.

Cybercriminals can be an innovative bunch when it comes to finding new ways to distribute malware.
The latest example is a new campaign involving the use of a fake digital certificate update to try and infect systems of visitors to previously compromised websites.
Security vendor Kaspersky on Thursday reported that its researchers had recently observed visitors to various websites being greeted with a warning about the sites security certificate having expired and being invited to download an updated one instead. Users who fell for the lure ended up downloading malware on their systems.
The campaign appears to have started around mid-January and impacted visitors to several websites, including one belonging to a zoo and another to an auto parts dealer. Kaspersky said it is not immediately clear how exactly the attackers behind the campaign might have initially infected these sites.
According to Kaspersky, the campaign is the first one its researchers have encountered where attackers are attempting to distribute malware in the guise of a website security update. The method is a slight twist on an approach that attackers have employed for a long time of hiding malware in fake software and browser updates and Adobe Flash installs. Attackers have planted such updates on legitimate sites and tried to trick users into downloading them under various pretexts — or they have tricked them to navigating to sites hosting the malicious updates.
People are particularly susceptible to this type of attack because it appears on legitimate websites — ones theyve possibly already visited, says Victoria Vlasova, a malware analyst at Kaspersky.
In the latest campaign, users to infected websites are greeted with a notification through an iframe about the sites security certificate being out of date. The contents of the iframe are from a third-party resource and are simply overlaid on top of the original page. As a result, the URL bar still displays the legitimate address of the compromised website, Kaspersky
said in a report
. The iframe overlay is also exactly the same size as the page so users wouldnt have an easy way to proceed to the site if they chose to ignore the fake notification.
Because the address listed in the iframe is, in fact, the real address of the website, the natural instinct for users is to install the recommended certificate so they can view the content they want to, Vlasova says. However, users should always be wary when prompted to download something by an online source, she adds. Chances are, its not necessary.”
Campaign Being Used to Distribute Mokes & Buerak Malware
In the new campaign that Kaspersky observed, attackers are distributing Mokes and Buerak, two previously known pieces of malware, under the guise of a security certificate update.
Mokes
is a backdoor from several years ago that can be used to download other malware, steal credentials, and intercept data that users might enter into a Web form. The malware, referred to by some as Smoke Loader, can also be used to install shell code on an infected computer, according to Kaspersky. Buerak has similar functionality and can be used to spread other malware, including crypto-mining software, ransomware, remote access Trojans, and keyloggers.
As incidents involving certificate issuance and deployment become more well-known and mainstream, attackers have one more avenue to use in creating attacks that leverage social engineering efforts said Pratik Savla, senior security engineer at Venafi. Unfortunately, and also unsurprisingly, we are bound to see an uptick of this kind of campaign.
Related Content:
Social Media Platforms Double as Major Malware Distribution Centers
Attackers Focus on More Disruptive Ransomware Infections
Exploitation, Phishing Top Worries for Mobile Users
6 Truths About Disinformation Campaigns

Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays featured story:
The Perfect Travel Security Policy for a Globe-Trotting Laptop
.

Last News
▸ Nigerian scammers now turning into mediocre malware pushers. ◂ Discovered: 23/12/2024 Category: security	▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Attackers Distributing Malware Under Guise of Security Certificate Updates