SYMANTEC INTELLIGENCE REPORT JUNE 2015

Transcription

1 SYNTEC INTELLIGENCE REPORT UNE 015

2 une Summary 4 une in Numbers 5 Targeted ttacks & Phishing 5 Top 10 Industries Targeted in Spear-Phishing ttacks 5 Spear-Phishing ttacks by Size of Targeted Organization 6 Phishing Rate 6 Proportion of Traffic Identified as Phishing by Industry Sector 7 Proportion of Traffic Identified as Phishing by Organization Size 8 Vulnerabilities 8 Total Number of Vulnerabilities 8 Zero-ay Vulnerabilities 9 Vulnerabilities isclosed in Industrial Control Systems 10 alware 10 New alware Variants 10 Top 10 ac OSX alware Blocked on OSX Endpoints 11 Ransomware Over Time 11 Crypto-Ransomware Over Time 1 Proportion of Traffic in Which alware Was etected 1 Percent of alware as URL vs. ttachment by onth 13 Proportion of Traffic Identified as alicious by Industry Sector 13 Proportion of Traffic Identified as alicious by Organization Size 14 obile & Social edia 14 ndroid obile alware amilies by onth 14 New ndroid Variants per amily by onth 15 Social edia Welcome to the une edition of the Symantec Intelligence report. Symantec Intelligence aims to provide the latest analysis of cyber security threats, trends, and insights concerning malware, spam, and other potentially harmful business risks. Symantec has established the most comprehensive source of Internet threat data in the world through the Symantec Global Intelligence Network, which is made up of more than 57.6 million attack sensors and records thousands of events per second. This network monitors threat activity in over 157 countries and territories through a combination of Symantec products and services such as Symantec eepsight Intelligence, Symantec anaged Security Services, Norton consumer products, and other third-party data sources. 16 Spam 16 Overall Spam Rate 16 Proportion of Traffic Identified as Spam by Industry Sector 17 Proportion of Traffic Identified as Spam by Organization Size 18 bout Symantec 18 ore Information

3 3 une 015 Summary There is good news this month on the -based front of the threat landscape. ccording to our metrics, the overall spam rate has dropped to 49.7 percent. This is the first time this rate has fallen below 50 percent of for over a decade. The last time Symantec recorded a similar spam rate was clear back in September of 003. Phishing rates and -based malware were also down this month. However, there were 57.6 million new malware variants created in une, up from 44.5 million pieces of malware created in ay and 9. million in pril. This increase in activity lends more evidence to the idea that, with the continued drops in -based malicious activity, attackers are simply moving to other areas of the threat landscape. Ransomware attacks are up in une, with over 477,000 detected during the month. While still below the levels seen at the end of 014, this is the second month in a row ransomware attacks have increased since they reached a 1-month low in pril. Crypto-ransomware is also up in une, reaching the highest levels seen since ecember 014. In other news, after a busy month in ay targeted attacks against the anufacturing industry leveled out in une, dropping from 41 percent to percent. anufacturing still comes out on top in terms of sectors subject to targeted attacks, but activity is now in line with what is being seen in the inance, Insurance, & Real Estate sector and the Services Professional sector, which come in at second and third place. We hope that you enjoy this month s report and feel free to contact us with any comments or feedback. Ben Nahorney, Cyber Security Threat nalyst symantec_intelligence@symantec.com

4 4 une 015 UNE IN NUBERS

5 5 une 015 Targeted ttacks & Phishing anufacturing inance, Insurance, & Real Estate une ay % 41 The anufacturing sector was targeted with the greatest volume of spear-phishing attacks in une, as percent were directed at manufacturing organizations. Services - Professional 5 17 Transportation, Communications, Electric, Gas, & Sanitary Services 6 1 Services - Non Traditional 9 8 Wholesale 8 9 Construction <1 7 Nonclassifiable Establishments Retail ining <1 Top 10 Industries Targeted in Spear-Phishing ttacks Top 10 Industries Targeted in Spear-Phishing ttacks Company Size une ay % 4.5% % 5.1% % 6.6% Large enterprises were the target of 5.1 percent of spear-phishing attacks in une, down from 39. percent in ay. In contrast, 38.1 percent of attacks were directed at organizations with less than 50 employees %.7% % 3.9% % 39.% Spear-Phishing ttacks by Size of Targeted Organization Spear-Phishing ttacks by Size of Targeted Organization

6 6 une 015 S O N 015 The overall phishing rate has decreased slightly this month, where one in,448 s was a phishing attempt IN Phishing Rate Inverse Graph: Smaller Number = Greater Risk Phishing Rate Industry une ay griculture, orestry, & ishing 1 in 1, in Public dministration 1 in, in 1,89.3 Services - Professional 1 in, in 1,76. The griculture, orestry, & ishing sector was once again the most targeted Industry overall for phishing attempts in une, where phishing comprised one in every 1,470 s. This rate was higher than any other industry in either ay or une. Nonclassifiable Establishments 1 in, in 1,834.9 inance, Insurance & Real Estate 1 in, in 1,349.9 Construction 1 in 3, in,14.9 ining 1 in 3, in,30.6 Services - Non Traditional 1 in 3, in,408. Wholesale 1 in 4, in,878. Transportation, Communications, Electric, Gas, & Sanitary Services 1 in 4, in,840. Proportion of Traffic Identified as Phishing Proportion by Industry of Sector Traffic Identified as Phishing by Industry Sector.cloud

7 7 une 015 Company Size une ay in 1, in 1,473.9 Small companies with less than 50 employees were again the most targeted organization size in une in, in 1, in 3, in 1, in 3, in 1, in 3, in, in 3, in,80.8 Proportion of Traffic Identified as Phishing by Organization Size.cloud Proportion of Traffic Identified as Phishing by Organization Size

8 8 une 015 Vulnerabilities The number of vulnerabilities declined in une, down from 579 in ay to 56 vulnerabilities reported during the month S O N Total Number of Vulnerabilities 015 Total Number of Vulnerabilities 3 There was a one zero-day vulnerability discovered in ay, the dobe lash Player CVE Unspecified Heap Buffer Overflow Vulnerability S O Zero-ay Vulnerabilities N 015 Zero-ay Vulnerabilities

9 9 une Vulnerabilities Unique Vendors While two vulnerabilities in industrial control systems were reported by one vendor in pril, none were reported in ay or une Vulnerabilities isclosed in Industrial Control Systems S O N 015 Vulnerabilities isclosed in Industrial Control Systems ethodology In some cases the details of a vulnerability are not publicly disclosed during the same month that it was initially discovered. In these cases, our vulnerability metics are updated to reflect the time that the vulnerability was discovered, as opposed to the month it was disclosed. This can cause fluctuations in the numbers reported for previous months when a new report is released. 0

10 10 une 015 alware There were more than 57.6 million new pieces of malware created in une, up from 44.5 million created in ay. ILLIONS S New alware Variants New alware Variants O N 015 Rank alware Name une Percentage alware Name ay Percentage 1 OSX.RSPlug. 9.5% OSX.RSPlug. 3.9% OSX.RSPlug. continues to be the most commonly seen OS X threat seen on OS X endpoints in une, up 5.6 percentage points from ay. OSX.Keylogger 11.6% OSX.Keylogger 14.0% 3 OSX.Klog. 8.9% OSX.Wirelurker 9.0% 4 OSX.Luaddit 7.8% OSX.Luaddit 8.3% 5 OSX.Wirelurker 7.1% OSX.Klog. 8.0% 6 OSX.lashback.K 5.4% OSX.lashback.K 6.4% 7 OSX.Stealbit.B 4.3% OSX.Netweird 3.9% 8 OSX.reezer 3.% OSX.Sabpab 3.8% 9 OSX.Netweird.9% OSX.Stealbit.B 3.6% 10 OSX.Okaz.5% OSX.lashback 3.0% Top 10 ac OS X alware Blocked on OS X Endpoints Top 10 ac OSX alware Blocked on OSX Endpoints

11 11 une Ransomware attacks were up in une for the second month in a row, where over 477 thousand attacks were detected. THOUSNS S O Ransomware Over Time N 015 Ransomware Over Time Crypto-ransomware was also up duing une, reaching its highest levels since ecember of 014. THOUSNS S O N Crypto-Ransomware Over Time 015 Crypto-Ransomware Over Time

12 1 une S O N 015 The proportion of traffic containing malware decreased again this month, down from one in 07 s in ay to one in 319 s in une. 1 IN Inverse Graph: Smaller Number = Greater Risk Proportion of Traffic in Which alware Was etected Proportion of Traffic in Which alware Was etected The percentage of malware that contains a URL remained low in une, hovering around three percent S O N 015 Percent of alware as URL vs. ttachment by onth Percent of alware as URL vs. ttachment by onth

13 13 une 015 Industry une ay Transportation, Communications, Electric, Gas, & Sanitary Services 1 in in griculture, orestry, & ishing 1 in in The Transportation, Communications, Electric, Gas, & Sanitary Services sector was the most targeted industry in une, with one in 30 s containing malware. Public dministration 1 in in Services - Professional 1 in in Wholesale 1 in in Construction 1 in in 40.9 Services - Non Traditional 1 in in 36.6 ining 1 in in 35.8 inance, Insurance, & Real Estate 1 in in 9.8 Nonclassifiable Establishments 1 in in 55.9 Proportion of Traffic Identified as alicious by Industry Sector.cloud Proportion of Traffic Identified as alicious by Industry Sector Company Size une ay in in in in Organizations with employees were most likely to be targeted by malicious in the month of une, where one in 164 s contained malware in in in 9. 1 in in in in in Proportion of Traffic Identified as alicious by Organization Size.cloud Proportion of Traffic Identified as alicious by Organization Size

14 14 une 015 obile & Social edia In une there was one new mobile malware familiy discovered S O N 015 ndroid obile alware amilies by onth ndroid obile alware amilies by onth 50 There was an average of 40 ndroid malware variants per family in the month of in une S O N 015 New ndroid Variants per amily by onth New ndroid Variants per amily by onth

15 15 une Last 1 onths In the last twelve months, 83 percent of social media threats required end users to propagate them ake offerings comprised 11 percent of social media threats anual Sharing 11 ake Offering 5 Likejacking 1.4 ake pps 0.1 Comment acking anual Sharing These rely on victims to actually do the work of sharing the scam by presenting them with intriguing videos, fake offers or messages that they share with their friends. ake Offering These scams invite social network users to join a fake event or group with incentives such as free gift cards. oining often requires the user to share credentials with the attacker or send a text to a premium rate number. Likejacking Using fake Like buttons, attackers trick users into clicking website buttons that install malware and may post updates on a user s newsfeed, spreading the attack. ake pps Users are invited to subscribe to an application that appears to be integrated for use with a social network, but is not as described and may be used to steal credentials or harvest other personal data. Comment acking This attack is similar to the "Like" jacking where the attacker tricks the user into submitting a comment about a link or site, which will then be posted to his/her wall. Social edia Social edia

16 16 une 015 Spam % 51.5% -1.8% pts -0.6% pts 5.1% The overall spam rate further declined in une, dropping below 50 percent, to 49.7 percent. une ay pril Overall Spam Rate Overall Spam Rate Industry ay pril ining 56.1% 55.4% anufacturing 53.7% 53.7% t over 56 percent, the ining sector had the highest spam rate again during une. The anufacturing sector came in second with 54 percent. Construction 53.3% 54.1% Retail 53.1% 5.1% Services - Non Traditional 53.0% 51.6% Services - Professional 5.6% 5.5% griculture, orestry, & ishing 5.3% 5.3% Public dministration 5.3% 51.4% Wholesale 5.% 5.1% inance, Insurance, & Real Estate 51.9% 51.7% Proportion of Traffic Identified as Spam by Industry Sector Proportion.cloud of Traffic Identified as Spam by Industry Sector

17 17 une 015 Company Size ay pril % 5.7% % 5.6% While all organization sizes had around a 5-53 percent spam rate, organizations with employees had the highest rate at 53. percent % 5.0% % 5.% % 5.% % 5.% Proportion of Traffic Identified as Spam by Organization Size.cloud Proportion of Traffic Identified as Spam by Organization Size

18 18 une 015 bout Symantec Symantec Corporation (NSQ: SYC) is an information protection expert that helps people, businesses and governments seeking the freedom to unlock the opportunities technology brings anytime, anywhere. ounded in pril 198, Symantec, a ortune 500 company, operating one of the largest global data-intelligence networks, has provided leading security, backup and availability solutions for where vital information is stored, accessed and shared. The company s more than 0,000 employees reside in more than 50 countries. Ninety-nine percent of ortune 500 companies are Symantec customers. In fiscal 014, it recorded revenues of $6.7 billion. To learn more go to or connect with Symantec at: go.symantec.com/socialmedia. ore Information Symantec Worldwide: ISTR and Symantec Intelligence Resources: Symantec Security Response: Norton Threat Explorer: Norton Cybercrime Index:

19 Symantec Corporation World Headquarters 350 Ellis Street ountain View, C US +1 (650) (800) or specific country offices and contact numbers, please visit our website. or product information in the U.S., call toll-free 1 (800) Copyright 015 Symantec Corporation. ll rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners 04/15 1,