Forest Global Training Partners

Cyber Risks · Cisco Talos

Threat Source newsletter for June 4, 2020

Summary: Cisco Talos reported attackers infecting websites with fake certificate-expiration notices that keep the legitimate URL in the address bar while displaying a full-window image claiming the security certificate is out of date; clicking the download button installs the Buerak downloader and Mokes malware. Talos also reported a new ZeuS fork called "Silent Night," dating back to November and sold on a Russian dark web forum, which fetches a core malicious module and injects it into running processes using techniques and code similar to ZeuS.

What you should know: The certificate warning is one of the few browser signals users are trained to trust, and this campaign turns it into a delivery mechanism for the Buerak downloader and Mokes malware while the URL bar still shows the real site. A ZeuS-derived banking trojan with matching code and techniques is now openly for sale on a Russian forum, putting that capability in reach of buyers who never built it themselves.

Read the original at Cisco Talos ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026