M86 Security bi-annual report focuses on second half of 2010 cyber threats and key trends; more complex Trojans and next generation malware on the way, social network attacks continue to increase
Orange, Calif. – February 14, 2011 – Frustrated email users may have noticed a significant drop in spam in recent months, but cybercriminals are gaining ground with creative new phishing methods and making exploit kits more robust, according to the latest Security Labs Report from M86 Security, the global expert in real-time Web and email threat protection, which was released today.
Investigating the cyber threat trends in the second half of 2010 for its bi-annual report, M86 Security Labs analyzed spam, phishing, and malware activity, and tracked global Internet security trends. Millions of email messages, infected Web pages and malware samples were reviewed and then correlated with their own Web exploit and vulnerability research, providing M86 with a unique vantage point to report on these trends.
“What is especially noteworthy is that our findings demonstrate that vulnerabilities already patched are continuing to be successfully used for malicious gain. Organizations and individuals must get better at updating their applications and staying ahead of attacks on their devices and their networks,” said Bradley Anstis, vice president of technical strategy, M86 Security. “While the M86 Security Labs report notes that great strides are being made in thwarting cyber-criminal attempts, there is always something else coming through the back door.”
Key findings by the M86 Security Labs for the second half of 2010:
Email Spam is Declining, though Far from Dead: According to the M86 Security Labs research, spam volume has slowed considerably, down to one-third the level at year end when compared to June 2010. Using the M86 Security Labs Spam Volume Index, which tracks changes in the volume of spam received by representative domains, the research shows that spam reduction was affected by botnet disruptions and the closure of a popular affiliate program. This is the lowest since November 2008, when the rogue hosting provider McColo was taken offline.
Botnet Take-downs and Spamit.com Closure: Notably, Spamit.com, an underground affiliate program used by several spamming botnets, was shut down in late September 2010. Spamit.com was linked to Glavmed and the “Canadian Pharmacy” brand of bogus online pharmacies. The Rustock botnet was most affected, with its spam output drastically reduced. However, plenty of other botnets moved up to take its place, and trends in this threat category will continue to be monitored for changes and increases. Other spamming categories in the top four include those for replica watches, fake diplomas and cheap watches. In August, notorious spammer/botnet, Pushdo/Cutwail, was taken down, resulting in a significant spam volume decrease due to a coordinated takedown attempt by security researchers. According to Anstis, such efforts are typically short lived, with the botnets returning to their normal activities. Another well-known botnet, Mega-D, has been taken down multiple times since 2008, only to return. In November 2010, the FBI identified and apprehended Oleg Nikolaenko, a Russian behind the botnet. The botnet since has generated less than 5 percent spam by volume. M86 Labs analysts point to the continuing need to go after and prosecute botnet operators for more long-term impact on spam operations and volumes.
Third-Party Phishing on the Rise: The good news about phishing is that such practices delivered via email are declining dramatically as users are becoming more aware of fake e-mails claiming to be from banking institutions. The bad news: cyber-thieves have found more effective means of stealing bank information from users visiting legitimate banking websites. Malware, including Trojans like SpyEye and ZeuS, are increasingly popular methods for criminals to make off with personal and financial information.
Additionally, attacks posing as third-party agencies such as the IRS and the New Zealand Department of Inland Revenue are being used to phish for a user’s bank account information under the guise of receiving bogus tax refunds. This makes it easier for thieves to obtain information from unsuspecting users by providing multiple options to the user to select the bank of their choice, thus eliminating the guessing game typically played to determine where a user conducts their banking. UK banking customers have been similarly affected, receiving a falsified email purporting to be from HM Revenue and Customs with the same legitimate looking page with options for all banks in that specific region.
Exploit Kits with Virus Scanners, Social Network Attacks Increase: As previously reported by M86 Security, the popularity of exploit kits is on the rise. The newest trend is that more kits are offering services to their customers thus becoming more of a “one-stop shop.” The scanning module in the Siberia Exploit kit and Neosploit’s new Malware-as-a-Service offering are just a couple of significant examples signaling a shift in exploit kit capabilities.
While traditional forms of spamming via email are down, spam techniques using such social networking sites as Twitter, Facebook and LinkedIn, continue to expand. The LinkedIn scam has a legitimate look and feel, inviting users to connect with others in their “network,” only to be connected with the Phoenix exploit kit infection page, which tries to exploit the victims’ computer through various vulnerabilities. The M86 Security Labs report also tracks the top 10 exploit kits being used worldwide.
To download the complete version of the latest M86 Security Labs Report, please go to http://m86.it/2h2010
About M86 Security Labs
M86 Security Labs is a group of security analysts specializing in Email and Web threats, from spam to malware. They continuously monitor and respond to Internet security threats. The Security Labs’ primary purpose is to provide a value-added service to M86 customers as part of product maintenance and support. This service includes frequent updates to M86’s unique, proprietary anti-spam technology, SpamCensor, as well as Web threat and vulnerability updates to the M86 Secure Web Gateway products. The updates allow M86 customers to proactively detect and block new and emerging exploits, threats and malware.
Data and analysis from M86 Security Labs is continuously updated and always accessible online at http://www.m86security.com/labs and on Twitter at http://twitter.com/m86labs
About M86 Security
M86 Security is the global expert in real-time threat protection and the industry’s leading Secure Web Gateway provider. The company’s appliance, software, and Software as a Service (SaaS) solutions for Web and email security protect more than 24,000 customers and over 17 million users worldwide. M86 products use patented real-time code analysis and behavior-based malware detection technologies as well as threat intelligence from M86 Security Labs to protect networks against new and advanced threats, secure confidential information, and ensure regulatory compliance. The company is based in Orange, California with international headquarters in London and development centers in California, Israel, and New Zealand. For more information about M86 Security, please visit: www.m86security.com.
- M86 Security Provides Virtual Appliance Version of its Award-Winning Secure Web Gateway, Enhances Protection Against Dynamic Threats
- Commtouch Introduces Industry’s First Unified Engine Combining Three Internet Security Technologies
- Trend Micro™ Launches Titanium™ with “Free Security Makeovers”
- Panda Security Launches Beta Version of Panda Global Protection 2011
- AVG Web Intelligence Report