June 2011 Symantec Intelligence Report
•
0 likes•14,771 views
Symantec Corp. announced the publication of its June 2011 Symantec Intelligence Report, the first Symantec report to combine the best research and analysis from the Symantec.cloud MessageLabs Intelligence Report and the Symantec State of Spam & Phishing Report. This month's analysis reveals that spam is currently at the lowest level it has been since the takedown of McColo, a California based ISP which hosted command and control channels for a number of major botnets, in November 2008.
Recommended
More Related Content
Similar to June 2011 Symantec Intelligence Report
Similar to June 2011 Symantec Intelligence Report (20)
More from Symantec
More from Symantec (20)
Recently uploaded
Recently uploaded (20)
June 2011 Symantec Intelligence Report
- 1. Symantec Intelligence Report June 2011 Symantec Intelligence 1
- 2. New: The Symantec Intelligence Report The new Symantec Intelligence Report combines the best research and analysis from Symantec: • Symantec.cloud MessageLabs Intelligence Report • Symantec State of Spam & Phishing Report The Symantec Intelligence Report integrated report provides the latest analysis of cyber security threats, trends and insights from the Symantec Intelligence team The data used to compile the analysis for this combined report includes data from May and June 2011. Symantec Intelligence 2
- 3. June 2011 Highlights • Spam – 72.9% in June (a decrease of 2.9 percentage points since May 2011) • Viruses – One in 300.7 emails in June contained malware (a decrease of 0.12 percentage points since May 2011) • Phishing – One in 330.6 emails comprised a phishing attack (a decrease of 0.05 percentage points since May 2011) • Malicious Web sites – 5,415 Web sites blocked per day (an increase of 70.8% since May 2011) • 35.1% of all malicious domains blocked were new in June (a decrease of 1.7 percentage points since May 2011) • 20.3% of all Web-based malware blocked was new in June (a decrease of 4.3 percentage points since May 2011) • Report highlights – Review of Spam-sending botnets in June 2011 – Clicking to Watch Videos Leads to Pharmacy Spam – Wiki for Everything, Even for Spam – Phishers Return for Tax Returns – Fake Donations Continue to Haunt Japan – Spam Subject Line Analysis Symantec Intelligence 3
- 4. Spam Rate & Sources 4
- 5. Trend Showing Fluctuating Global Daily Spam Volume over Twelve Months Symantec Intelligence 5
- 6. Proportion of Spam Sent from Botnets Since March 2011 Symantec Intelligence 6
- 7. Top Ten Spam-Sending Botnets (relative volumes) Since March 2011 Symantec Intelligence 7
- 8. Most Active Spam-Sending Botnets Spam % of /bot estimated Botnet spam spam/day spam/min /min botnet size Country of Infection Cutwail 16.1% 9,609,745,048 6,673,434 77 800k to India (10%), Russia (9%), Brazil (8%) 1200k Xarvester 6.7% 4,002,042,186 2,779,196 455 57k to 86k United Kingdom (18%), France (13%), Italy (9%) Maazben 3.1% 1,872,408,382 1,300,284 14 520k to Rep. of Korea (14%), Russia (10%), India (10%) 780k Lethic 3.1% 1,824,416,511 1,266,956 45 230k to Rep. of Korea (25%), Russia (15%), Ukraine (7%) 340k Grum 3.0% 1,801,605,428 1,251,115 140 200k to Russia (14%), India (14%), Ukraine (8%) 290k Bagle 2.7% 1,599,896,533 1,111,039 58 140k to India (15%), Russia (1%), Argentina (8%) 200k Fivetoone 2.3% 1,400,401,724 972,501 98 94k to 140k Vietnam (20%), Brazil (12%), Indonesia (11%) Festi 1.2% 691,992,804 480,551 166 25k to 37k India (10%), Vietnam (10%), Brazil (9%) Bobax 0.4% 254,229,254 176,548 24 80k to 120k Ukraine (27%), India (18%), Russia (18%) DarkMailer 0.5% 42,575,225 29,566 351 1k to 1.5k France (27%), USA (16%), Germany (13%) Other, smaller 0.5% 22,277,510 15,470 321 62k to 95k Botnets Unnamed Botnets 36.9% 21,962,912,697 15,252,023 196 660k to 990k Total Botnet Spam 76.6% 45,084,503,302 31,308,683 162 Non-botnet spam 23.4% 3,411,165,479 2,368,865 Grand Total 48,495,668,780 33,677,548 Symantec Intelligence 8
- 9. Geographical Distribution of Spam-Sending Botnets Country % of Spam Korea, Republic of (South Korea) 11.2% Russian Federation 11.1% India 8.7% Ukraine 6.1% Brazil 5.3% Vietnam 2.9% United States 2.8% United Kingdom 2.4% Taiwan 2.4% Romania 2.3% Symantec Intelligence 9
- 10. Global Spam Categories Category Name June 2011 Pharmaceutical 40.0% Adult/Sex/Dating 19.0% Watches/Jewelry 17.5% Newsletters 11.5% Casino/Gambling 7.0% Unknown 2.5% Degrees/Diplomas 1.5% Weight Loss 1.0% Symantec Intelligence 10
- 11. Spam Subject Line Analysis Total Spam: May 2011 Top Subject No. of No. of Rank Lines Days Total Spam: April 2011 Top Subject Lines Days 1 Blank Subject line 31 Re: ru girl 24 Re: Windows 7, Office 2010, Adobe 2 16 Blank Subject line 30 CS5 … 3 im online now 31 Re: Windows 7, Office 2010, Adobe CS5 … 12 4 my new pics :) 31 Save-80%-On-Viagra-Levitra-And-Cialis 14 5 drop me a line 31 Express Delivery system notification 7 6 r u online now? 31 Re:Hi 29 7 hi darling.. 31 Re: sale wiagrow 7 Do you have problem with ErectileDysfunction? ViagraCan help you and 8 new email 31 16 make sure it is a unique drug for treatingImpotence. BuyV!AGRA (SildenafilCitrate) Generic 9 found you :) 31 Tablets – Online Drugstore. ViagraCan help 16 your ErectileDysfunction Find Out How You Can Start Making $6487 a 10 my hot pics :) 31 19 Month At HOME Symantec Intelligence 11
- 12. Additional Spam Metrics Spam URL TLD Distribution Spam Attack Vectors 16% Change TLD May April (% points) com 53.4% 55.0% -1.6 12% ru 19.2% 10.1% +9.1 info 14.9% 18.5% -3.6 8% net 5.5% 6.9% -1.4 Average Spam Message Size 4% Change Message Size May April (% points) 0kb-5kb 62.33% 69.59% -7.26 0% 16 May 19 May 22 May 25 May 01 May 04 May 07 May 10 May 13 May 28 May 31 May 5kb-10kb 24.23% 16.18% +8.05 10kb+ 13.44% 14.23% -0.79 Attachment NDR Malware Symantec Intelligence 12
- 14. Most Frequently Blocked Email Malware Malware Name % Malware Exploit/SuspLink-d1f2 4.85% Link-Trojan.Generic.5483393-4cac 2.89% W32/NewMalware!836b 2.41% W32/NewMalware!0575 2.39% Exploit/Link-FakeAdobeReader-8069 2.32% Trojan.Bredolab!eml-1f08 1.97% Exploit/LinkAliasPostcard-d361 1.52% W32/Packed.Generic-7946 1.46% W32/Bredolab.gen!eml 1.36% Exploit/FakeAttach-844a 1.39% Symantec Intelligence 14
- 15. Phishing Rate & Sources 15
- 16. Phishing Website Locations Symantec Intelligence 16
- 17. Tactics of Phishing Distribution Symantec Intelligence 17
- 18. Organizations Spoofed in Phishing Attacks, by Industry Sector Symantec Intelligence 18
- 19. New Malware and Spyware Sites Per Day Symantec Intelligence 19
- 20. Policy, Malware & Potentially Unwanted Programs Symantec Intelligence 20
- 21. Most Frequently Blocked Malware at the Endpoint Malware Name % Malware W32.Ramnit!html 9.47% W32.Sality.AE 8.49% Trojan.Bamital 8.23% W32.Ramnit.B!inf 7.59% W32.Downadup.B 3.76% W32.Virut.CF 2.70% W32.Almanahe.B!inf 2.50% W32.SillyFDC 1.99% Trojan.ADH.2 1.91% Trojan.ADH 1.90% Generic Detection* 16.9% [1] For further information on these threats, please visit: http://www.symantec.com/business/security_response/landing/threats.jsp Symantec Intelligence 21