Report: Cybercriminals Continue To Diversify Attack Tactics To Sustain Spam, Malware Levels

Symantec Corp. recently announced the launch of its MessageLabs Intelligence 2010 Security Report. The annual report details how cyber criminals have diversified their attack tactics to sustain spam and malware at high levels throughout 2010.

The report highlights fluctuating spam levels throughout the year driven by changes in botnet activity. Spam rates peaked in August 2010 at 92.2 percent when the Rustock botnet was being aggressively seeded by new malware variants and quickly put to use, lending to an overall increase in spam activity for the year, with average spam levels reaching 89.1 percent, an increase of 1.4 percent compared with 2009.

For most of 2010 spam from botnets accounted for 88.2 percent of all spam. The end of 2010 saw a reduction in the contribution of botnets to spam, to 77 percent of spam, resulting from the closure of spam affiliate, Spamit, in early October 2010. By the end of 2010, the total number of active bots had returned to roughly the same number as at the end of 2009, increasing by approximately 6 percent in the latter half of 2010. The total number of botnets worldwide is between 3.5 and 5.4 million.

It is predicted that in 2011 botnet controllers will resort to employing steganography techniques to control their computers. This means hiding their commands in plain view -- perhaps within images or music files distributed through file sharing or social networking web sites. This approach will allow criminals to surreptitiously issue instructions to their botnets without relying on an ISP to host their infrastructure thus minimizing the chances of discovery.

Although 2010 has experienced fluctuation in the number of botnets and their associated output, the top three botnets have not changed in the latter half of 2010. Rustock remains the most dominant botnet, with its spam output more than doubled since last year to more than 44 billion spam emails per day and more than one million bots under its control while Grum and Cutwail are the second and third largest respectively. Cutwail and Grum have also been responsible for an increase in the volume of malware being sent in spam from botnets.

“With successful and resilient botnet operations established in prior years, the cyber criminals experimented with many tactics to keep spam campaigns active and fresh this year,” said Paul Wood, MessageLabs Intelligence Senior Analyst, Symantec Hosted Services. “From leveraging newsworthy events like the FIFA World Cup to taking advantage of the widespread popularity of URL shortening services and social networks, the spammers deployed a variety of tricks to bypass spam filters and lure potential victims.”

One noteworthy security threat this year was the ‘Here You Have’ virus which on September 9, 2010 used old mass-mailer techniques to send malicious e-mails, peaking at 2,000 e-mails blocked per minute. In total, MessageLabs AntiVirus service blocked more than 100,000 copies of the virus before it reached any client networks.

The heuristic rule that triggered the detection of the virus was added in May 2008, more than two years earlier. The same rule was again instrumental in stopping a run of attacks spoofing the U.S. Internal Revenue Service in early November.

In 2010, there were more than 339,600 different malware strains identified in malicious emails blocked, representing over a hundred-fold increase since 2009. This massive increase is largely due to the growth in polymorphic malware variants, typically generated from toolkits that allow a new version of the code to be generated quickly and easily.

An example of this includes the Bredolab family of Trojans, a general-purpose botnet commonly distributed via the Cutwail botnet, which accounted for approximately 7.4 percent of all e-mail-borne malware in 2010. Bredolab represents an approach from attackers referred to as “pay per install” (PPI). Although flexible in nature, the malware is designed to seize control of the victim’s computer so that the computer can be used by the Bredolab operators or rented or sold to another attacker. Bredolab is an example of malware contained in a compressed archive and over time has evolved from a simple piece of encrypted malware packed with polymorphic code to a protected version with an updated polymorphic engine designed to behave the same yet evade detection as Bredolab. The final version is an aggressive polymorphic packer released at the end of 2010 which was mass-mailed with hundreds of variants of it to maximize infection.

While Bredolab was being sent en masse, targeted attacks, characterized by their low-volume distribution, have also been on the rise. When targeted attacks, or advanced persistent attacks, first emerged five years ago, MessageLabs Intelligence tracked one to two per week and over the course of the following year, this number rose to between one and two attacks per day. Subsequently, targeted attacks increased from ten per day to approximately 60 per day in 2010 and by the end of the year, MessageLabs Intelligence blocked 77 targeted attacks each day.

“With the rise of targeted attacks come variations in the execution and attack complexity,” Wood said. “Typically, between 200 and 300 organizations are targeted each month but the industry sector varies and high seniority job roles are most frequently targeted yet often by way of a general or assistant’s mailbox. While five years ago large and well-known organizations were often targeted, today the scope of targeted organizations has expanded and now no organization is safe from attack.”

Finally, MessageLabs Intelligence examined the web browsing habits of an increasingly distributed workforce comprised of workers who are on the road or work from home compared to those of office-based workers. The findings revealed that mobile users behave similarly to office-based users and therefore pose little additional threat to an organization whereas workers who have mixed locations, those that work both in and out of the office, appear to relax their browsing habits considerably when out of the office, posing considerably higher risk to the organization. Based on the findings, organizations must determine to what extent they will manage employee online behavior with web policy controls. Recognizing a need for more flexible web access, businesses in 2010 are opting for a more granular approach to control with an increased use of “allow-lists” replacing the blanket “block list” approach from previous years. The number of allow policies has grown at an average rate of 0.8 percent per month in 2010, compared with 0.6 percent per month in 2009.

Top Trends in 2010

Web Security: For 2010, the average number of new malicious websites blocked each day rose to 3,066 compared to 2,465 for 2009, an increase of 24.3 percent. MessageLabs Intelligence identified malicious web threats on 42,926 distinct domains, the majority of which were compromised legitimate domains.

Spam: In 2010 the annual average global spam rate was 89.1 percent, an increase of 1.4 percent on the 2009. In August, the global spam rate peaked at 92.2 percent when the proportion of spam sent from botnets rose to 95 percent as a new variant of the Rustock botnet was seeded and quickly put to use.

Viruses: In 2010, the average rate for malware contained in email traffic was 1 in 284.2 emails (0.352 percent) almost unchanged when compared with 1 in 286.4 (0.349%) for 2009. In 2010, over 115.6 million emails were blocked by Skeptic™ representing an increase of 58.1 percent compared with 2009. There were 339.673 different malware strains identified in the malicious emails blocked. This represents more than a hundred fold increase over 2009 and is due to growth in polymorphic malware variants.

Phishing: In 2010, the average ratio of email traffic blocked as phishing attacks was 1 in 444.5 (0.23 percent), compared with 1 in 325.2 (0.31 percent) in 2009. Approximately 95.1 billion phishing emails were projected to be in circulation in 2010.

The annual MessageLabs Intelligence Report provides greater detail on all the trends and figures noted above, as well as more detailed trends for 2010. The full report is available at


  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity


New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3