Loading story…
Security researchers highlighted how attackers can obtain valid TLS certificates through domain-validation bypasses without compromising the target server, citing the 2023 jabber.ru incident in which fraudulent Let's Encrypt certificates were reportedly used to support man-in-the-middle interception of XMPP traffic. The attack was described as long-running, affecting multiple jabber.ru servers hosted in Germany, and demonstrated how control over DNS responses or network paths can enable trusted certificate issuance that appears legitimate to clients.
Guidance from Let's Encrypt and independent researchers points to CAA accounturi restrictions as a stronger control by binding certificate issuance to a specific ACME account URL, alongside DNSSEC and restrictive CAA policy. Let's Encrypt documents that account IDs are exposed as ACME account URLs and can be retrieved by clients such as Certbot, enabling operators to configure these bindings and report issues accurately. Researchers also urged organizations to monitor Certificate Transparency logs, compare logged certificates with locally deployed certificates, and use external certificate and TLS-fingerprinting checks to detect unauthorized issuance and possible MITM activity earlier.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Pentagrid published an analysis of the jabber.ru certificate abuse case and recommended mitigations including DNSSEC, restrictive CAA records, CAA accounturi constraints, and certificate transparency monitoring to detect or prevent fraudulent certificate issuance.
A long-running attack reportedly targeted the Russian Jabber/XMPP service jabber.ru from April to October 2023, with attackers apparently obtaining valid Let's Encrypt certificates to support man-in-the-middle interception. The campaign reportedly affected three jabber.ru network servers hosted by Hetzner and Linode in Germany.
Let's Encrypt published documentation explaining how subscribers can identify their ACME account ID, including Certbot-specific methods and alternative ways other ACME clients may expose the identifier.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Academic researchers disclosed a fundamental weakness in **attested TLS**, the remote attestation mechanism used by confidential computing platforms to prove a server is running inside a trusted execution environment (**TEE**). The team, led by Muhammad Usama Sardar of TU Dresden, found that current intra-handshake attestation designs do not securely bind attestation evidence to the actual TLS connection, enabling relay or diversion attacks in which a client validates a genuine attested server or AI agent but unknowingly sends encrypted traffic to a different malicious machine. The issue has been assigned **`CVE-2026-33697`** and rated high severity. The researchers formally analyzed seven cryptographic binding approaches and reported that none prevented this attack class, raising concerns that stronger “level-three” binding may be unattainable within the current architecture. Reported affected implementations include **Meta’s Private Processing for WhatsApp**, **Edgeless Systems’ Contrast**, **Cocos AI**, and a **Confidential Computing Consortium** proof of concept. Standards groups including the **IETF SEAT** and **TLS** working groups have acknowledged the findings, while the researchers recommended moving away from intra-handshake attestation toward **post-handshake attestation** as a safer alternative.
Jul 12, 2026
TrustAsia revoked **143 SSL/TLS certificates** after identifying a vulnerability in its *LiteSSL* ACME issuance service that enabled **improper reuse of domain validation artifacts** across different ACME accounts. The issue, tracked in **Mozilla Bugzilla `#2011713`**, led TrustAsia to **suspend ACME issuance**, investigate scope, and perform a mass revocation of impacted certificates issued via ACME after **2025-12-29**; TrustAsia reports the service has been **patched and restored**. Technical reporting indicates the root cause was a **logic/authorization handling failure** in LiteSSL’s ACME implementation: the system did not reliably ensure that a certificate request (CSR) was tied to the **same ACME account** that completed the original validation (notably for **DNS-01** challenges), enabling potential “**hijack**” re-issuance scenarios (including wildcard certificates) without fresh validation. Additional observations included client-IP attribution problems behind a reverse proxy (requests appearing to originate from an internal address), which contributed to anomalous behavior and helped surface the underlying validation/authorization weakness; the net risk was unauthorized certificate issuance that could support **man-in-the-middle** attacks if abused.
Jun 29, 2026
Researchers disclosed **Underminr**, a CDN abuse technique that allows attackers to conceal malicious connections behind trusted, high-reputation domains hosted on shared content delivery infrastructure. Unlike classic domain fronting, the method relies on a legitimate DNS lookup to an allowed domain that resolves to a shared CDN IP, while the actual connection presents the blocked destination in the TLS `SNI` field and HTTP `Host` header, enabling cross-tenant routing that many defenses fail to detect. ADAMnetworks said it has already observed insider threats using the technique to bypass controls, and warned it could support command-and-control traffic, malware delivery, phishing, data exfiltration, and access to malicious sites. The issue is being described as an architectural weakness rather than a software flaw, with **no CVE and no simple patch**. ADAMnetworks' analysis of nearly **5 million** Tranco-ranked websites across **73 CDN providers** found roughly **42% of domains** and **33 providers** were susceptible, while broader estimates suggested the exposure could extend to **more than 88 million domains** across major platforms including **Cloudflare, Akamai, AWS CloudFront, and Fastly**. Researchers and defenders recommended deep packet inspection, validating `SNI` and `Host` header consistency, monitoring unusual traffic to reputable domains, reviewing CDN tenant isolation, and working with providers; ADAMnetworks also released a lookup tool for domain owners and an open-source monitoring tool called **Outminr**.
Jun 29, 2026