Domain Kiting Tactic Continues to Grow as Overall Online Threats Remain Largely Stable in May

MessageLabs Intelligence Report details geographic and industry variances in spam, virus and phishing activity.

June 5, 2006; 07:29 AM
NEW YORK - MessageLabs, a leading provider of integrated messaging and web security services to businesses worldwide, today announced the findings of its MessageLabs Intelligence Report for May. Overall threat levels have remained relatively stable as in previous months, with Hong Kong and Israel being the most spammed countries at 64 percent, while Malaysia saw the largest increase in virus attacks during May (one in 15.1 emails), putting it second only to India, which leads with 1 in 9.6 emails containing a virus.

"The reality we face today is that cyber criminals have become more adept at harvesting infected computers' address books and using simple techniques to amplify their reach," said Mark Sunner, chief technology officer, MessageLabs. "This has turned the traditional botnet or zombie into a virtual spam cannon - capable of blasting out millions of emails a day. Disposable domains are also becoming a larger problem via a tactic known as 'domain kiting' in which cyber criminals acquire domains without paying for them and use them for illegal gains."

Spam: In May, the global ratio of spam in email traffic from new and unknown bad sources was 57.9 percent (1 in 1.7), an increase of 0.6 percent on the previous month.

Viruses: In May, the global ratio of viruses in email traffic from new and previously unknown bad sources destined for valid recipients was 1 in every 67.1 emails (1.5 percent), a decrease of 0.3 percent since April. MessageLabs continues to observe that large scale virus outbreaks have almost become a thing of the past, as attacks are becoming increasingly more targeted and with specific business motives.

Phishing: May showed an increase of 0.03 percent in the proportion of phishing attacks compared with the previous month; with one in every 322.8 (0.31 percent) emails being a phishing attack. The number of phishing attacks also increased by 5.2 percent as a proportion of all email-borne threats, now accounting for 20.8 percent of all malicious emails intercepted by MessageLabs in May. MessageLabs expects phishing to be on the rise in coming months, due to the phishers growing ability to be increasingly targeted in their attacks, known as spear-phishing. Coupled with better botnet data harvesting techniques, this presents a continued problem to enterprises and consumers alike.

Spyware: Spyware continues to be an increasingly pervasive and growing problem. Spyware has become intrinsic to the means by which bot technology has converged with viruses, trojans and spam - and the boundaries between them are almost impossible to distinguish. A traditional botnet may be likened with peas in a tube - by pushing one pea in, another pea pops-out at the other end - providing a degree of anonymity, but not very scalable. However, the latest techniques use a mail-merge tactic that combines lists of harvested names and email addresses with email templates - all downloaded from a control server on demand - thus transforming the botnets of old into a veritable "spam cannon" able to pump out millions of emails per hour using mass-mailing, mail-merge technology.

Geographic Trends:

-- India continues to be the most affected country in the virus chart, with the proportion of virus laden emails decreasing to one in 9.6 (3.7 percent) since April.

-- The greatest increase in virus traffic was seen in Malaysia, where virus borne traffic email rose by 4.5 percent on the previous month to one in 15.1 emails containing a virus.

-- Sweden continues to be the least affected, with one in 155.1 emails containing a virus.

-- Hong Kong received the greatest proportion of spam which still dropped slightly by 1.4 percent on the previous month.

-- Globally, there has been a drop of two percent in spam. However, the U.K. bucked this trend with a two percent increase in spam rates.

Vertical/Industry Trends:

-- The vertical most targeted in May, with 1 in 21.5 of emails containing a virus, was the wholesale sector.

-- Business support services (now ranked 15) bore the greatest decline in viruses, falling 17.4 percent to 0.9 percent (1 in 106.6).

-- The education sector witnessed the greatest rise in virus traffic, with 1 in 33.7 emails harboring a virus; this is an increase of 0.9 percent since April.

-- The vertical most affected by email spam was the chemical & pharmaceutical industry, increasing by 4.5 percent to 61.4 percent.

-- The greatest drop in spam was seen within the wholesale sector (ranked 12 this month), which saw spam traffic fall by 9 percent to 43.6 percent.

The May MessageLabs Intelligence Report details security threats for twenty different vertical industries, as well as more detailed geographical trends. The full report is available at http://www.messagelabs.com/Threat_Watch/Intelligence_Reports.

MessageLabs Intelligence is a respected source of data and analysis for messaging security issues, trends and statistics. MessageLabs provides a range of information on global security threats based on live data feeds from our control towers around the world.

About MessageLabs

MessageLabs is the world's leading provider of messaging security and management services with more than 14,000 clients and offices in eight countries. For more information, please visit www.messagelabs.com.

US: MessageLabs Shelley Driscoll, 646-519-8102 [email protected] or Weber Shandwick Kryssa Guntrum, 212-445-8110, [email protected] or EMEA: MessageLabs Kirsten Ackroyd, +44 (0) 207 291 7939 [email protected] or Weber Shandwick for MessageLabs, +44 (0) 20 7067 0500 [email protected] or APAC: MessageLabs Andrew Antal, +61 2 8208 7171 [email protected] or Spectrum Communications Saxon Shirley, +61 2 9954 3299 [email protected]