FortiGuard Center
Threat Research and Response
Threatscape Report - April 2009 Edition
The following statistics are compiled from Fortinet's FortiGate network security appliances and intelligence systems for the period March 21st - April 20th, 2009.
Exploits and Intrusion PreventionTop 10 Exploitations & RegionsTop 10 exploitation attempts detected for this period, ranked by vulnerability traffic. Percentage indicates the portion of activity the vulnerability accounted for out of all attacks reported in this edition. Severity indicates the general risk factor involved with the exploitation of the vulnerability, rated from low to critical. Critical issues are outlined in bold:
 Figure 1a: Top 5 regions by detected exploit attempts New Vulnerability Coverage
Malware Today
Regions & VolumeTop 5 regions for this period, ranked by distinct malware volume reported. Distinct malware volume indicates the amount of unique virus names (variants) that has been detected in the given regions, as opposed to total malware volume, which indicates the accumulated amount of all reported incidents. Total and unique malware volume trends for the last six reporting periods are also given. Figures 3a-3c below show these statistics:
For more information on daily activity per region, please visit our Virus World Map. Spam and Email Threats
Top 3 In The WildTop three email threats observed for this period. Top e-mails have been filtered to highlight diverse campaigns by removing duplicates and unsolicited advertisements. This helps focus on scams and malicious intent; the resulting list is ranked by Figures 5a-c below illustrate the most popular message tactics used during recent spam campaigns:
Crawling The WebWeb Traffic & GrowthThe following list breaks down the percentage of activity blocked for selected Web categories throughout this period. Percentage indicates how much activity was accounted for out of the four selected categories. Figure 6a shows a different scope, comparing only threat traffic: Malware, spyware, and phishing. The percentage shown in Figure 6a below indicates how much activity was accounted for out of these three threat categories. Figure 6b highlights the growth (or reduction) of selected web threat activity when compared period over period:
Activity RecapAfter three months of shifting variants within our malware Top 10, there was considerable action to report about this period. Four new variants entered the picture, while W32/Virut.A maintained its dominance in first position for the second straight month. Amongst the new variants were online gaming and adware threats. In fact, three entries in our malware top 10 (ranked #2 through #4) were linked to online gaming trojans - a fourth trojan just missed our list as it was ranked in eleventh position. Needless to say, these threats have formed a significant portion of malware activity. The lucrative marketplace created through online gaming certainly has attracted cyber crime with haste, as we have reported over the past year. Real money trading (RMT) is now an estimated $2 billion USD annual market, that is surrounded by illegitimate practices, fueled by threats like the ones you see present in third and fourth position in our malware top ten this period. For distinct malware volume this period, China leap-frogged over Japan and the USA (Figure 3a) with a 44.86% global share, up from 24.17% last period. This is partly thanks to the increased presence of the aforementioned gaming threats: these have a heavy influence in Asia, following market share as we reported one year ago. As a world wide whole (Figures 3b/3c), both total and distinct malware volume increased this period marking the highest levels we have detected this year. While Conficker.C sat idle on the much anticipated April 1st time-bomb date incorporated into its code, its peer to peer network became active the week after when new code was injected. Prior to this, we saw a considerable drop in MS08-067 exploit activity since the latest Conficker.C variant had stopped attacking this vulnerability. However, new code exploiting this now infamous security hole surfaced through both Conficker and another malware family. As a result, exploit activity for MS08-067 has once again picked up towards the end of April. Our detection for this exploit, MS.DCERPC.NETAPI32.Buffer.Overflow, landed in third position in our top 10 exploitation list. This combination of activity is likely to continue occurring, especially as new threats are created that hope to piggyback on the success of Conficker's first attack vehicle. The Waledac gang was at it once again, hosting yet another campaign serving up its variants disguised as SMS mobile spying software. Figure 5a shows a sample of their simple, malicious email spewed out from their botnet. This is turning out to be a monthly event, as it is the fifth major campaign we have witnessed with Waledac this year. Once again, they ripped off a legitimate website's template to enhance their social engineering effect. Nothing new there, as we saw this copy-paste practice with their previous 'Couponizer' theme and Obama campaign. This is one network to watch out for, since it is very active and employs heavy server side polymorphism. Ensure you have an effective antivirus and webfiltering solution in place. Waledac is built on an effective peer to peer network of proxies, that use HTTP communication and a variety of domains built on fast flux. In other words, they aren't going away any time soon - especially considering Waledac variants were recently spotted on Conficker's massive network of zombies. Other notable spam this month include a nigerian 419 scam social engineered to be from Hong Kong (Figure 5b), and a template rip-off from Men's Health magazine courtesy of the Canadian Pharmacy gang (Figure 5c). All of the links in the latter e-mail lead to the Canadian Pharmacy network, and certainly not Men's Health. Yet another attempt to leverage a legitimate name, be careful out there. Web threat traffic generally increased this period, with Phishing sites growing more than Spyware (Figure 6b). SolutionsCustomers who use Fortinet’s FortiGuard Subscription Services should already be protected against the threats outlined in this report. Threat activity is compiled by Fortinet's FortiGuard Global Security Research Team using data gathered from its intelligence systems and FortiGate™ multi-threat security appliances in production worldwide. FortiGuard Subscription Services offer comprehensive security solutions including antivirus, intrusion prevention, Web content filtering and antispam capabilities. These services enable protection against threats on both application and network layers. FortiGuard Services are continuously updated by the FortiGuard Global Security Research Team, which enables Fortinet to deliver a combination of multi-layered security intelligence and true zero-day protection from new and emerging threats. These updates are delivered to all FortiGate, FortiMail and FortiClient products. |
