The evolution of targeted attacks and exploit kits
There’s been a significant growth in cybercrime, via sophisticated targeted attacks and social media scams, as well as a rise in malicious email attachments, despite a four-year low in spam volumes last year, according to M86 Security.
Investigating the Web and email threat trends in the second half of 2011, M86 Security Labs analyzed spam and malware activity, including the current use of exploit kits, fraudulent digital certificates and social networking schemes, and tracked global Internet security trends.
The countries hosting the largest shares of malicious Web content are:
While spam levels have declined, the proportion of malicious spam has increased from 1% to 5% in the last half of the year.
“We already know that cybercriminals have become adept at circumventing mainstream security solutions, and as we find more fraud perpetrated through social networking sites and mobile devices, it is imperative for organizations to educate their users and complement their reactive protection with proactive, real-time technologies to enhance their security posture,” said Bradley Anstis, Vice President of Technical Strategy, M86 Security. “Many of the trends we forecast, such as the increased use of stolen digital certificates in targeted attacks, have occurred. Our goal is to help organizations preempt these complex attacks before malware has a chance to infiltrate networks and cause very real damage.”
Critical national infrastructure is targeted
As targeted attacks become more sophisticated, cybercriminals are pursuing a wider range of organizations, including commercial, national critical infrastructure and military targets. Confirmed attacks in 2011 include RSA, Lockheed Martin and the Asia-Pacific Economic Cooperation (APEC). Dutch company DigiNotar, for example, detected an intrusion that resulted in the fraudulent issuance of hundreds of digital certificates for a number of domains, including Google, Yahoo, Facebook, the CIA, the British MI6 and the Israeli Mossad.
Stolen digital certificates are increasingly used in successful targeted attacks
Stealing or faking digital certificates has become an important component of a targeted attack. Digital certificates are used to confirm and assure a user that the downloaded application truly is from the trusted vendor. With stolen certificates, cybercriminals can distribute malware and sign it with a legitimate company certification, thus tricking users to confidently download the application.
The Blackhole exploit kit dominates the exploit kits market
In late 2011, Blackhole established itself as the most successful exploit kit. Its authors increased its update frequency and added new ways to evade detection, such as checking the software version on the client machine before attempting to exploit it.
The volume of malicious spam escalated in 2011
Though overall spam volume decreased as of December 2011, the proportion of malicious spam rose in the second half of the year from less than 1% to 5%, with a spike in malicious attachments occurring in August and September. As noted previously, there was a shift from malicious attachments to the use of embedded links to infected content later in the year.
Social media is a haven for fraudulent posts and scams
It is now mainstream practice for spammers to use bogus social media notifications to dupe users into clicking on infected links. Perhaps even more troubling is the success with which cybercriminals capitalize on user trust and familiarity to make Facebook, for example, a conduit for spam and malware propagation. Many of these campaigns are spread virally by enticing users to share posts for “rewards” or “gift cards” with their friends.