Symantec Intelligence Report - June 2014

SYMANTEC INTELLIGENCE REPORT
JUNE 2014

p. 2
Symantec Corporation
Symantec Intelligence Report :: JUNE 2014
CONTENTS
3 Summary
4 TARGETED ATTACKS + DATA BREACHES
5 Targeted Attacks
5 Attachments Used in Spear-Phishing
Emails
5 Spear-Phishing Attacks by Size of
Targeted Organization
5 Average Number of Spear-Phishing
Attacks Per Day
6 Top-Ten Industries Targeted
in Spear-Phishing Attacks
7 Data Breaches
7 Timeline of Data Breaches
8 Total Identities Exposed
8 Top Causes of Data Breaches
8 Total Data Breaches
9 Top-Ten Types of Information Breached
10 MALWARE TACTICS
11 Malware Tactics
11 Top-Ten Malware
11 Malicious Activity by Source: Bots
12 Top-Ten Mac OSX Malware
12 Ransomware Over Time
13 Vulnerabilities
13 Number of Vulnerabilities
13 Zero-Day Vulnerabilities
14 Browser Vulnerabilities
14 Plug-in Vulnerabilities
15 SOCIAL MEDIA
+ MOBILE THREATS
16 Mobile
16 Mobile Malware Families by Month,
Android
16 Number of Android Variants
Per Family
17 Mobile Threat Classifications
18 Social Media
18 Social Media
19 PHISHING, SPAM + EMAIL THREATS
20 Phishing and Spam
20 Phishing Rate
20 Global Spam Rate
21 Email Threats
21 Proportion of Email Traffic
Containing URL Malware
21 Proportion of Email Traffic
in Which Virus Was Detected
22 About Symantec
22 More Information

p. 3
Summary
Welcome to the June edition of the
Symantec Intelligence report. Symantec
Intelligence aims to provide the latest
analysis of cyber security threats, trends,
and insights concerning malware, spam, and
other potentially harmful business risks.
Symantec has established the most
comprehensive source of Internet threat
data in the world through the Symantec™
Global Intelligence Network, which is made
up of more than 41.5 million attack sensors
and records thousands of events per second.
This network monitors threat activity in
over 157 countries and territories through
a combination of Symantec products and
services such as Symantec DeepSight™
Threat Management System, Symantec™
Managed Security Services, Norton™
consumer products, and other third-party
data sources.
The largest data breach reported in June resulted in the exposure
up 1.3 million identities. This seems like a small number when
compared to the 145 million exposed in the largest breach of
May. However, while reported in June, this breach also took
place during the month of May. This brings the total number
of identities exposed in May to over 147 million, which is the
second-worst month for data breaches in the last 12 months.
There was an average of 88 spear-phishing attacks per day in
June. This appears to be a return of spear-phishing levels seen
in the months of March and April, after the average per day
dropped in May.
A relatively new OSX threat by the name of OSX.Stealbit.B
topped our list of OSX malware, responsible for 25.7 percent of
OSX threat found on OSX systems. This threat looks for specific
bitcoin-related software on OSX computers and will attempt to
modify the programs in order to steal bitcoins.
The number of Android variants per family reached the lowest
levels seen in the last twelve months. While there was not a
significant change in the number of families discovered in
June, this may indicate that attackers have had more success
with their current set of threats, reducing their need to create
multiple variants.
June was a quiet month for vulnerabilities, where (only) 438
were reported—tying the lowest number reported in the last 12
months. There were no zero day vulnerabilities disclosed during
the month.
We hope that you enjoy this month’s report and feel free to
contact us with any comments or feedback.
Ben Nahorney, Cyber Security Threat Analyst
symantec_intelligence@symantec.com

p. 4
Symantec Intelligence Report :: JUNE 2014TARGETEDATTACKS
+DATABREACHES

p. 5
At a Glance
• The average number of
spear-phishing attacks
per day returned to similar
levels seen in March and
April, after dropping in May.
• The .doc file type continues
to be the most common
attachment type used in
spear-phishing attacks,
followed by .exe files.
• Organizations with 2500+
employees were the most
likely to be targeted in May.
• The Top-Ten Industries
targeted remains largely
unchanged from May, with
minor shifts of less than
one percent for various
industries.
Targeted Attacks
Average Number of Spear-Phishing
Attacks Per Day
Source: Symantec :: JULY 2013 — JUNE 2014
25
50
75
100
125
150
175
200
225
250
JMAMFJ
2014
DNOSAJ
171
188
21
116
54
141
84 84
54
88
103
165
Attachments Used in Spear-Phishing
Emails
Source: Symantec :: JUNE 2014
Executable type June May
.doc 19.5% 17.7%
.exe 15.4% 16.1%
.au3 11.5% 11.8%
.jpg 6.2% 7.0%
.scr 5.8% 6.4%
.class 2.1% 1.6%
.pdf 1.7% 1.3%
.bin 1.1% 1.2%
.mso 0.6% —
.dmp 0.6% —
Spear-Phishing Attacks by Size
of Targeted Organization
Organization Size June May
1-250 36.3% 37.0%
251-500 8.4% 8.6%
501-1000 9.3% 9.0%
1001-1500 3.0% 3.0%
1501-2500 4.1% 4.1%
2500+ 38.9% 38.3%

p. 6
Top-Ten Industries Targeted in
Spear-Phishing Attacks
Mining
Construction
Retail
Transportation, Gas,
Communications, Electric
Public Administration
Wholesale
Services – Professional
Finance, Insurance
& Real Estate
Manufacturing
Services – Non-Traditional 22%
19
17
11
9
6
6
3
1
1

p. 7
Data Breaches
At a Glance
• The largest data breach reported in June took place during the
month of May.
• With 1.3 million identities exposed in this breach, this brings
the total identities exposed in May to 147 million.
• Hackers have been responsible for 49 percent of data breach-
es in the last 12 months.
• Real names, government ID numbers, such as Social Security
numbers, and home addresses were the top three types of
data exposed in data breaches.
20
40
60
80
100
120
140
160
JMAMFJDNOSAJ
NUMBEROFINCIDENTS
IDENTITIESEXPOSED(MILLIONS)INCIDENTS IDENTITIES EXPOSED (Millions)
Timeline of Data Breaches
147
2.7 .91.72.6
8
130
113
159
.8.3
8
37
17
27
22
22
28
27
23
18
16
9
20
5
10
15
20
25
30
35
40

p. 8
Top Causes of Data Breaches
Unknown
Fraud
Insider Theft
Theft or Loss
of Computer
or Drive
Accidentally
Made Public
Hackers
49%
20%
23%
7%
.4%
.4%
Number
of Incidents
131
62
52
19
1
1
266TOTAL
Total Data
Breaches
JULY 2013 — JUNE 2014
266
Total Identities
Exposed
JULY 2013 — JUNE 2014
574Million

p. 9
Top-Ten Types of Information Breached
Real Names
Gov ID numbers (Soc Sec)
Home Address
Birth Dates
Medical Records
Financial Information
Phone Numbers
Email Addresses
Usernames & Passwords
Insurance
01
02
03
04
05
06
07
08
09
10
74%
46%
44%
44%
33%
26%
20%
18%
14%
9%
Methodology
This data is procured from the Norton Cybercrime Index (CCI). The Norton CCI is a statistical model
that measures the levels of threats, including malicious software, fraud, identity theft, spam,
phishing, and social engineering daily. The data breach section of the Norton CCI is derived from
data breaches that have been reported by legitimate media sources and have exposed personal
information.
In some cases a data breach is not publicly reported during the same month the incident occurred,
or an adjustment is made in the number of identities reportedly exposed. In these cases, the data in
the Norton CCI is updated. This causes fluctuations in the numbers reported for previous months
when a new report is released.
Norton Cybercrime Index
http://us.norton.com/protect-yourself

p. 10
MALWARETACTICS

p. 11
Malware Tactics
At a Glance
• W32.Sality and
W32.Ramnit variants
continue to dominate the
top-ten malware list.
• The United States contin-
ues to be the largest
source of bot activity.
• The most common
threat on OSX was
OSX.Stealbit.B, making
up 26 percent of all OSX
malware found on OSX
Endpoints.
Malicious Activity by Source: Bots
Rank Country/Region Percent
1 United States 21.9%
2 China 10.6%
3 Taiwan 7.1%
4 Hungary 5.0%
5 Italy 4.4%
6 Brazil 3.0%
7 Japan 2.9%
8 Canada 2.7%
9 France 2.6%
10 Germany 2.2%
Top-Ten Malware
Rank Name Percentage
1 W32.Sality.AE 5.3%
2 W32.Ramnit!html 5.1%
3 W32.Ramnit.B 3.8%
4 W32.Almanahe.B!inf 3.7%
5 W32.Downadup.B 2.9%
6 W32.Ramnit.B!inf 2.6%
7 W32.SillyFDC.BDP!lnk 2.1%
8 W32.Virut.CF 1.6%
9 Trojan.Malscript 1.4%
10 Trojan.Zbot 1.4%

p. 12
Top-Ten Mac OSX Malware Blocked
on OSX Endpoints
Malware Name
Percent of Mac Threats
Detected on Macs
OSX.Stealbit.B 25.7%
OSX.RSPlug.A 24.1%
OSX.Flashback.K 14.7%
OSX.HellRTS 6.0%
OSX.Sabpab 4.9%
OSX.SMSSend 4.5%
OSX.Keylogger 2.5%
OSX.Loosemaque 2.2%
OSX.Remoteaccess 2.0%
OSX.Flashback 1.6%

p. 13
Number of Vulnerabilities
100
200
300
400
500
600
700
800
JMAMFJ
2014
DNOSAJ
438
561
469
549
438
471
542 562 579
473
663
555
Zero-Day Vulnerabilities
1
2
3
4
5
6
7
8
JMAMFJ
2014
DNOSAJ
0
1
0 0 0
2 2
0
5
0
1
4
Vulnerabilities
At a Glance
• Vulnerabilities are at
their lowest levels seen in
the last 12 months.
• There were no zero-day
vulnerabilities discovered
in June.
• Internet Explorer has
reported the most brows-
er vulnerabilities in the
last 12 months.
• Oracle’s Java reported
the most plug-in vulner-
abilities over the same
time period.

p. 14
Browser Vulnerabilities
20
40
60
80
100
JMAMFJ
2014
DNOSAJ
Opera
Mozilla Firefox
Microsoft Internet Explorer
Google Chrome
Apple Safari
Plug-in Vulnerabilities
10
20
30
40
50
60
70
80
Java
Apple
Adobe
ActiveX
JMAMFJ
2014
DNOSAJ

p. 15
Symantec Intelligence Report :: JUNE 2014SOCIALMEDIA
+MOBILETHREATS

p. 16
Mobile
Mobile Malware Families by Month,
Android
8
2
7
2
4
2
4
2
3
44
3
1
2
3
4
5
6
7
8
9
10
JMAMFJ
2014
DNOSAJ
Number of Android Variants Per Family
20
40
60
80
100
120
JMAMFJ
2014
DNOSAJ
20
107
36
93
33
60
41
80
66
18
48 46
At a Glance
• There were four Android
malware families discov-
ered in June.
• The number of variants
per family reached its
lowest levels seen in the
last 12 months.
• Of the threats discovered
in the last 12 months, 28
percent track the device’s
user and 21 percent steal
information from the
device.
• In terms of social
networking scams,
78 percent were fake
offerings.

p. 17
Mobile Threat Classifications
Track User Risks that spy on the individual using the device, collecting SMS
messages or phone call logs, tracking GPS coordinates, recording phone calls,
or gathering pictures and video taken with the device.
Steal Information This includes the collection of both device- and user-specific
data, such as device information, configuration data, or banking details.
Traditional Threats Threats that carry out traditional malware functions,
such as back doors and downloaders.
Reconfigure Device These types of risks attempt to elevate privileges
or simply modify various settings within the operating system.
Adware/Annoyance Mobile risks that display advertising or generally perform
actions to disrupt the user.
Send Content These risks will send text messages to premium SMS numbers,
ultimately appearing on the bill of the device’s owner. Other risks can be used to
send spam messages.
5
10
15
20
25
30
Adware
Annoyance
Send
Content
Reconfigure
Device
Traditional
Threats
Steal
Information
Track
User
7%
12%
21%21%
13%
24%

p. 18
Social Media
Social Media
70%
Fake Offers These scams invite social network users to join a fake event or group
with incentives such as free gift cards. Joining often requires the user to share
credentials with the attacker or send a text to a premium rate number.
Manual Sharing Scams These rely on victims to actually do the work of sharing
the scam by presenting them with intriguing videos, fake offers or messages that they
share with their friends.
Likejacking Using fake “Like” buttons, attackers trick users into clicking website
buttons that install malware and may post updates on a user’s newsfeed, spreading the
attack.
Comment Jacking Similar to likejacking, this type of scam relies on users clicking
links that are added to comments by attackers. The links may lead to malware or survey
scams.
Fake App Users are invited to subscribe to an application that appears to be
integrated for use with a social network, but is not as described and may be used to
steal credentials or harvest other personal data.
10
20
30
40
50
60
70
80
90%
Comment
Jacking
Fake
Apps
LikejackingManual
Sharing
Fake
Offering
20%
7%
1% .7%

p. 19
PHISHING,SPAM+EMAILTHREATS

p. 20
Phishing and Spam
Phishing Rate
1 in 100
1 in 200
1 in 300
1 in 400
1 in 500
1 in 600
1 in 700
1 in 800
1 in 900
JMAMFJ
2014
DNOSAJ
At a Glance
• The phishing rate for
June was one in 496
emails, down from one in
395 emails in May.
• The global spam rate
was 59.9 percent for the
month of June.
• One out of every 232
emails contained a virus.
• Of the email traffic in
the month of June, 7.4
percent contained a mali-
cious URL.
Global Spam Rate
10
20
30
40
50
60
70
80%
JMAMFJ
2014
DNOSAJ

p. 21
Email Threats
Proportion of Email Traffic
Containing URL Malware
5
10
15
20
25
30
35
40
45%
JMAMFJ
2014
DNOSAJ
1 in 50
1 in 100
1 in 150
1 in 200
1 in 250
1 in 300
1 in 350
1 in 400
1 in 450
1 in 500
JMAMFJ
2014
DNOSAJ
Proportion of Email Traffic
in Which Virus Was Detected

p. 22
About Symantec
More Information
• Symantec Worldwide: http://www.symantec.com/
• ISTR and Symantec Intelligence Resources: http://www.symantec.com/threatreport/
• Symantec Security Response: http://www.symantec.com/security_response/
• Norton Threat Explorer: http://us.norton.com/security_response/threatexplorer/
• Norton Cybercrime Index: http://us.norton.com/cybercrimeindex/
Symantec Corporation (NASDAQ: SYMC) is an information protection expert that helps
people, businesses and governments seeking the freedom to unlock the opportunities
technology brings – anytime, anywhere. Founded in April 1982, Symantec, a Fortune
500 company, operating one of the largest global data-intelligence networks, has
provided leading security, backup and availability solutions for where vital information
is stored, accessed and shared. The company’s more than 20,000 employees reside in
more than 50 countries. Ninety-nine percent of Fortune 500 companies are Symantec
customers. In fiscal 2013, it recorded revenues of $6.9 billion. To learn more go to
www.symantec.com or connect with Symantec at: go.symantec.com/socialmedia.

For specific country offices and contact numbers,
please visit our website.
For product information in the U.S.,
call toll-free 1 (800) 745 6054.
Symantec Corporation World Headquarters
350 Ellis Street
Mountain View, CA 94043 USA
+1 (650) 527 8000
1 (800) 721 3934
www.symantec.com
Copyright © 2014 Symantec Corporation.
All rights reserved. Symantec, the Symantec Logo,
and the Checkmark Logo are trademarks or registered
trademarks of Symantec Corporation or its affiliates in
the U.S. and other countries. Other names may
be trademarks of their respective owners

Symantec Intelligence Report - June 2014

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Viewers also liked

Viewers also liked (12)

Similar to Symantec Intelligence Report - June 2014

Similar to Symantec Intelligence Report - June 2014 (20)

More from Symantec

More from Symantec (20)

Recently uploaded

Recently uploaded (20)

Symantec Intelligence Report - June 2014