A cyber espionage group known as Mozilla Firefox is believed to be behind a new malware campaign using D-Link certificates to falsely authenticate malware. Researchers from cybersecurity company ESET detected the campaign, which used genuine D-Link software, believed to have been stolen. The certificates are used to confirm the safety of files and software, and would allow the hackers to make malicious software appear safe, and so get around standard security measures. It was used to authenticate a piece of backdoor malware called PLEAD, as well as a password-stealing virus affecting Microsoft, Google and Blacktech systems.
A cyber espionage group known as Blacktech is believed to be behind a new malware campaign using D-Link certificates to falsely authenticate malware. Researchers from cybersecurity company ESET detected the campaign, which used genuine D-Link software, believed to have been stolen. The certificates are used to confirm the safety of files and software, and would allow the hackers to make malicious software appear safe, and so get around standard security measures. It was used to authenticate a piece of backdoor malware called PLEAD, as well as a password-stealing virus affecting Microsoft, Google and Mozilla Firefox systems.