The Rise in SSL-based Threats

This Zscaler ThreatLabZ report summarizes observations from August 2016 to January 2017 showing a substantial and growing use of SSL/TLS by malicious actors to hide exploit kits, phishing pages, malware callbacks, and adware distribution. The cloud blocked an average of ~600,000 SSL-backed malicious activities per day (with spikes near 2 million), and the report documents specific malware families using SSL or embedded certificates, adware that installs root CAs to intercept HTTPS, and the operational challenges organizations face in inspecting encrypted traffic.