Report: Cybercriminals Continue To Diversify Attack Tactics To Sustain Spam, Malware Levels

Symantec Corp. recently announced the launch of its MessageLabs Intelligence 2010 Security Report. The annual report details how cyber criminals have diversified their attack tactics to sustain spam and malware at high levels throughout 2010.

The report highlights fluctuating spam levels throughout the year driven by changes in botnet activity. Spam rates peaked in August 2010 at 92.2 percent when the Rustock botnet was being aggressively seeded by new malware variants and quickly put to use, lending to an overall increase in spam activity for the year, with average spam levels reaching 89.1 percent, an increase of 1.4 percent compared with 2009.

For most of 2010 spam from botnets accounted for 88.2 percent of all spam. The end of 2010 saw a reduction in the contribution of botnets to spam, to 77 percent of spam, resulting from the closure of spam affiliate, Spamit, in early October 2010. By the end of 2010, the total number of active bots had returned to roughly the same number as at the end of 2009, increasing by approximately 6 percent in the latter half of 2010. The total number of botnets worldwide is between 3.5 and 5.4 million.

It is predicted that in 2011 botnet controllers will resort to employing steganography techniques to control their computers. This means hiding their commands in plain view -- perhaps within images or music files distributed through file sharing or social networking web sites. This approach will allow criminals to surreptitiously issue instructions to their botnets without relying on an ISP to host their infrastructure thus minimizing the chances of discovery.

Although 2010 has experienced fluctuation in the number of botnets and their associated output, the top three botnets have not changed in the latter half of 2010. Rustock remains the most dominant botnet, with its spam output more than doubled since last year to more than 44 billion spam emails per day and more than one million bots under its control while Grum and Cutwail are the second and third largest respectively. Cutwail and Grum have also been responsible for an increase in the volume of malware being sent in spam from botnets.

“With successful and resilient botnet operations established in prior years, the cyber criminals experimented with many tactics to keep spam campaigns active and fresh this year,” said Paul Wood, MessageLabs Intelligence Senior Analyst, Symantec Hosted Services. “From leveraging newsworthy events like the FIFA World Cup to taking advantage of the widespread popularity of URL shortening services and social networks, the spammers deployed a variety of tricks to bypass spam filters and lure potential victims.”

One noteworthy security threat this year was the ‘Here You Have’ virus which on September 9, 2010 used old mass-mailer techniques to send malicious e-mails, peaking at 2,000 e-mails blocked per minute. In total, MessageLabs AntiVirus service blocked more than 100,000 copies of the virus before it reached any client networks.

The heuristic rule that triggered the detection of the virus was added in May 2008, more than two years earlier. The same rule was again instrumental in stopping a run of attacks spoofing the U.S. Internal Revenue Service in early November.

In 2010, there were more than 339,600 different malware strains identified in malicious emails blocked, representing over a hundred-fold increase since 2009. This massive increase is largely due to the growth in polymorphic malware variants, typically generated from toolkits that allow a new version of the code to be generated quickly and easily.

An example of this includes the Bredolab family of Trojans, a general-purpose botnet commonly distributed via the Cutwail botnet, which accounted for approximately 7.4 percent of all e-mail-borne malware in 2010. Bredolab represents an approach from attackers referred to as “pay per install” (PPI). Although flexible in nature, the malware is designed to seize control of the victim’s computer so that the computer can be used by the Bredolab operators or rented or sold to another attacker. Bredolab is an example of malware contained in a compressed archive and over time has evolved from a simple piece of encrypted malware packed with polymorphic code to a protected version with an updated polymorphic engine designed to behave the same yet evade detection as Bredolab. The final version is an aggressive polymorphic packer released at the end of 2010 which was mass-mailed with hundreds of variants of it to maximize infection.

While Bredolab was being sent en masse, targeted attacks, characterized by their low-volume distribution, have also been on the rise. When targeted attacks, or advanced persistent attacks, first emerged five years ago, MessageLabs Intelligence tracked one to two per week and over the course of the following year, this number rose to between one and two attacks per day. Subsequently, targeted attacks increased from ten per day to approximately 60 per day in 2010 and by the end of the year, MessageLabs Intelligence blocked 77 targeted attacks each day.

“With the rise of targeted attacks come variations in the execution and attack complexity,” Wood said. “Typically, between 200 and 300 organizations are targeted each month but the industry sector varies and high seniority job roles are most frequently targeted yet often by way of a general or assistant’s mailbox. While five years ago large and well-known organizations were often targeted, today the scope of targeted organizations has expanded and now no organization is safe from attack.”

Finally, MessageLabs Intelligence examined the web browsing habits of an increasingly distributed workforce comprised of workers who are on the road or work from home compared to those of office-based workers. The findings revealed that mobile users behave similarly to office-based users and therefore pose little additional threat to an organization whereas workers who have mixed locations, those that work both in and out of the office, appear to relax their browsing habits considerably when out of the office, posing considerably higher risk to the organization. Based on the findings, organizations must determine to what extent they will manage employee online behavior with web policy controls. Recognizing a need for more flexible web access, businesses in 2010 are opting for a more granular approach to control with an increased use of “allow-lists” replacing the blanket “block list” approach from previous years. The number of allow policies has grown at an average rate of 0.8 percent per month in 2010, compared with 0.6 percent per month in 2009.

Top Trends in 2010

Web Security: For 2010, the average number of new malicious websites blocked each day rose to 3,066 compared to 2,465 for 2009, an increase of 24.3 percent. MessageLabs Intelligence identified malicious web threats on 42,926 distinct domains, the majority of which were compromised legitimate domains.

Spam: In 2010 the annual average global spam rate was 89.1 percent, an increase of 1.4 percent on the 2009. In August, the global spam rate peaked at 92.2 percent when the proportion of spam sent from botnets rose to 95 percent as a new variant of the Rustock botnet was seeded and quickly put to use.

Viruses: In 2010, the average rate for malware contained in email traffic was 1 in 284.2 emails (0.352 percent) almost unchanged when compared with 1 in 286.4 (0.349%) for 2009. In 2010, over 115.6 million emails were blocked by Skeptic™ representing an increase of 58.1 percent compared with 2009. There were 339.673 different malware strains identified in the malicious emails blocked. This represents more than a hundred fold increase over 2009 and is due to growth in polymorphic malware variants.

Phishing: In 2010, the average ratio of email traffic blocked as phishing attacks was 1 in 444.5 (0.23 percent), compared with 1 in 325.2 (0.31 percent) in 2009. Approximately 95.1 billion phishing emails were projected to be in circulation in 2010.

The annual MessageLabs Intelligence Report provides greater detail on all the trends and figures noted above, as well as more detailed trends for 2010. The full report is available at


  • Progressing in Capabilities

    Progressing in Capabilities

    Hazardous areas within industries like oil and gas, manufacturing, agriculture and the like, have long-sought reliable video surveillance cameras and equipment that can operate safely in these harsh and unpredictable environments. Read Now

  • A Comprehensive Nationwide Solution

    A Comprehensive Nationwide Solution

    Across the United States, manufacturing facilities, distribution centers, truck yards, parking lots and car dealerships all have a common concern. They are targets for catalytic converters. In nearly every region, cases of catalytic converter thefts have skyrocketed. Read Now

  • Planning for Your Perimeter

    Planning for Your Perimeter

    The perimeter is an organization’s first line of defense and a critical element of any security and surveillance program. Even if a building’s interior or exterior security is strong, without a solid perimeter surveillance approach any company or business is vulnerable. Read Now

  • The Key Issue

    The Key Issue

    It is February 2014. A woman is getting ready in her room on a cruise ship when she hears a knock on the door; it is a crewmember delivering breakfast. She is not presentable so she tells him to leave it by the door. Read Now

Featured Cybersecurity

New Products

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3

  • SecureAuth


    The acceleration of digital transformation initiatives as a result of COVID-19 has created a lasting impact on how businesses empower their workforce and engage customers. 3

  • PDK IO Access Control Software

    PDK.IO Access Control Software

    ProdataKey now allows for "custom fields" within the interface of its software. Custom fields increase PDK's solutions' overall functionality by allowing administrators to include a wide range of pertinent data associated with each user. 3