Do you really trust that certificate?
Summary: Cisco Talos added Snort rule SID 19551, issued 2011-07-14, to flag self-signed SSL certificates using the default "Internet Widgits Pty Ltd" organization name, after traffic from TDL4 botnet command-and-control connections showed that default name on their certificates. The rule is off by default because it could generate substantial false positives, and Talos recommends pairing it with SIDs 19496-19550, which look for DNS queries to the TDL4 C&C domains listed in a SecureList.com analysis.
What you should know: The TDL4 authors did not need a unique certificate to hide their command-and-control traffic - they used the default self-signed option, which means a detection built on a distinctive name would have missed them entirely.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026