Enhanced phishing methods on the rise

There’s been an increase in targeted and combined email-based threats, a new twist in phishing attacks, and an escalation in social engineering scams through popular social networking sites, according to M86 Security.

In analyzing cyber threat trends for the first half of 2011, M86 Security Labs noted that while spam levels are on the decline, cybercriminals continue to enhance their attack techniques, developing new ways, such as combined, embedded files or HTML attachments that go undetected by phishing protection, to entice potential victims and increase their success rates.

“Whether the attacks occur via email or the Web, one thing remains a constant: an increased emphasis on targeted, evasive malware that outpaces most security detection methods,” said Bradley Anstis, VP of technical strategy, M86 Security. “M86 Security Labs researches and documents these attacks to create a greater awareness of the very real cyber threats organizations face. By understanding the latest attack methods, enterprises and their security administrators can better prevent malware from infiltrating networks and systems.”

Targeted email-based attacks still a problem

Though Web-based attacks are more prominent today, attacks against RSA and Oak Ridge National Labs show that email-based targeted attacks, delivered via malicious attachments and blended threats, are still significant. While incidents of malicious attachments in email decreased in the second half of 2010, they increased from less than 1% to nearly 3% in the first half of 2011.

Conversely, spam volumes have dropped in 2011. According to the M86 Security Labs Spam Volume Index, which tracks changes in the volume of spam received by representative domains, spam levels have decreased by 1/3 of what they were from previous levels reported in the M86 Security Labs 2H2010 report

Increasingly sophisticated phishing attacks

Cybercriminals have found new ways to avoid detection to improve the success rates of phishing attacks. One of these methods, noted in the M86 Security Labs report, involves attaching HTML versions of banking websites to emails, rather than linking potential victims to bogus banking sites. Because users access these HTML files locally from their systems, the threats will not be flagged by browsers with built-in phishing protection.

Combined attacks on the rise

In the first half of 2011, M86 Security Labs saw an increase in targeted attacks that used Microsoft Excel files with embedded Flash (.swf) files to exploit vulnerabilities. This method, used in the targeted attack against RSA, is hard to detect by anti-virus and other security solutions because both components must be separated for analysis.

Social networking scams reach new levels

As noted in previous M86 Security Labs reports, sites such as Facebook and Twitter have become regular targets for scams. Now, in addition to coercing users to divulge personal information via surveys that earn scammers’ commissions, scams expose users to malware. For example, thousands of Facebook users have fallen victim to a malware campaign disguised as a link to a sex tape of former IMF chairman, Dominique Strauss-Kahn, following the allegations that he sexually assaulted a hotel maid in New York. The malware campaign remained active for more than 72 hours.

The complete report is available here.