Malicious content delivered over SSL/TLS has more than doubled in six months

Researchers share latest findings from the Zscaler cloud showing increasingly sophisticated malware strains using SSL to encrypt activity.

  • 6 years ago Posted in
Zscaler has publsihed the findings of a study from Zscaler™ ThreatLabZ showing that malicious threats using SSL encryption are on the rise in 2017. According to the study, an average of 60 percent of the transactions in the Zscaler cloud, the largest security cloud, have been delivered over SSL/TLS. Researchers also found that the Zscaler cloud saw an average of 8.4 million* SSL/TLS-based security blocks per day this year.
 
“Hackers are increasingly using SSL to conceal device infections, shroud data exfiltration and hide botnet command and control communications. In fact, our study found that the amount of phishing attempts per day delivered over SSL/TLS has increased 400 percent from 2016,” said Deepen Desai, senior director, security research and operations. “SSL inspection is a necessity in ensuring the security of network traffic in the enterprise. Zscaler sits between users and the internet, inspecting every byte of traffic, including encrypted traffic, so we can catch hidden threats before they get into the network.”
 
ThreatLabZ researchers also identified new malicious payload distributions, based off unique payloads hitting the Zscaler Cloud Sandbox, leveraging SSL/TLS for command and control (C&C) activity. Banking Trojans comprised 60 percent of the payloads, including families like Dridex, Zbot, Vawtrak and Trickbot, while 25 percent were comprised of multiple ransomware families. Less popular payloads included Infostealer Trojan families and other miscellaneous families.
 
Additional findings include:
  • The amount of malicious content being delivered over SSL/TLS has more than doubled in the last six months.
  • The Zscaler cloud blocked an average of 12,000 phishing attempts per day delivered over SSL/TLS—an increase of 400 percent from 2016.
  • New, increasingly sophisticated malware strains use SSL to encrypt their C&C mechanisms.
  • Zscaler saw an average of 300 hits per day for web exploits that included SSL as part of the infection chain.
  • The most prevalent malware family leveraging SSL-based callbacks was Dridex/Emotet, which contributed 34 percent of the total unique, new payloads in 2017.
  • New malicious payloads leveraging SSL/TLS for C&C activity:
    • 60 percent were comprised of multiple Banking Trojan families (Zbot, Vawtrak, Trickbot, etc.)
    • 25 percent were comprised of ransomware families
    • 12 percent were comprised of Infostealer Trojan families (Fareit, Papras, etc.)
    • 3 percent were from other miscellaneous families
Research shows ‘game needs to be changed,’ with security innovation years behind that of the...
73% of organizations lack automated patch management, and 62% experienced incidents involving...
Quest Software has signed a definitive agreement with Clearlake Capital Group, L.P. (together with...
Dell EMC PowerProtect Cyber Recovery for AWS provides a fast, easy-to-deploy public cloud vault to...
Aqua’s cloud native application protection platform becomes the only solution that protects cloud...
54% of organisations working on a security transformation project now or in the next 12 months.
Node4 has released its Mid-Market IT Priorities Report 2021. The independent report reveals that...
Zscaler Zero Trust exchange cloud-based architecture enables superior green security capabilities...