ESET has published its annual review of the past year's threat trends and compiled predictions for 2013. According to the new report, the 2013 threatscape will see major growth of mobile malware and its variants, increased malware propagation via websites and the continued rise of botnets and attacks on the cloud resulting in information leaks.


Over the past year, there has been a major increase in mobile malware. Devices running on the Android™ platform have drawn increased attention from malicious programmers who have taken an immediate interest in targeting this dynamic and growing market. According to market research firm IDC, during the first quarter of 2012, Google recorded year-over-year growth of 145 percent in shipments of its Android operating system for smartphones.

Based on the combination of increased market share, evolving usage patterns, and the current high level of malicious programs targeting mobile devices, ESET predicts an exponential growth of mobile malware in 2013. The company also believes that the malware will become more complex, thus expanding the range of malicious actions that can be performed on an infected device.

The number of malware families targeting the Android platform (malicious codes that are different enough to have a unique classification) increased from 52 families in November of 2011 to 56 families today. Although this figure did not rise dramatically during 2012, it shows that the number of signatures and variants continues to grow.

Regardless of the number of malware families, ESET expects the number of threats aimed at the Android platform to continue to grow, in much the same way as it has with Windows operating system. ESET classifies the behaviors of the families and malicious actions (payload) carried out by malware on Android-based devices as follows: information theft (spyware), SMS message distribution to premium-rate numbers, and the transformation of machines into zombies (botnet recruitment).

The majority of these malware families are intended to subscribe the victim to premium-rate messaging numbers. However, there are more serious threats that can transform these devices into zombies. This happens when cybercriminals gain access to the devices to remotely install other malicious code, steal particularly desirable data, and modify configuration parameters.

The number of malware variants for the Android platform also increased in 2012. A variant is a modified version of a specific and known malicious program. It is important to note that for each new major variant that emerges, the ESET research team adds an alphabetically ordered suffix that changes as the quantity increases.

In 2013, ESET also expects to see a shift in the ways in which cybercriminals propagate malicious code. Malware propagation by means of removable storage devices is decreasing in favor of the use of an intermediary in order to attract new victims.

Currently, the preferred intermediary is a web server that has been compromised by a third party in order to host computer threats. Cybercriminals will send out hyperlinks via email to lead the user to the malware in question. These same compromised servers store the stolen information in order to avoid involving personal computers, which may be better protected and where detection and cleaning of malware may result in the criminals losing their stolen data.

Since 2010, cybercriminals using malware designed to steal information and generate revenue have become more prevalent and their attacks more aggressive. During 2011, there was a marked increase in the number of botnets, and this year the numbers have continued a steady increase globally. There is no doubt that the Dorkbot worm is one of the most prolific threats, capable of turning the victim's computer into a zombie.

Storage in the cloud is another trend that grew in 2012. According to a June press release, in 2012, Gartner believes that the adoption of camera-equipped tablets and smartphones will drive consumer storage needs. Although this technology makes it easier for people to access information from practically any device with Internet access, it also makes such devices more susceptible to being targeted by computer attacks, which can compromise data security and cause information leaks.