 "Cyber criminals now use beneath-the-OS threats, digitally signed malware")
McAfee Labs revealed that sophisticated malware attacks are now increasingly being directed at critical sectors of the economy, while an emerging set of new tactics and technologies are being implemented to evade industry-standard security measures.
The report shows continued proliferation of password-stealing trojans and advanced persistent threats (APTs) such as Operation High Roller and Project Bliztkrieg, and the expansion of their attacks to government, manufacturing and commercial transaction infrastructure targets.
Earlier, such attacks were targeted at the financial services industry. This was a part of 'McAfee Threats Report: Fourth Quarter 2012,' which was released today.
In Q4 2012, McAfee Labs identified the following trends:
More Threats, More Availability, More Industries Targeted
As a group, unique password-stealing trojans grew 72% in fourth quarter (Q4) as cyber criminals realised that user authentication credentials constitute some of the most valuable intellectual property stored on most computers. Now widely available, these trojans are increasingly appearing within customised threats or combined with other “off-the-shelf” threats available on the internet. Revelations in Q4 around the Citadel trojan suggest that this trojan’s information theft capabilities are being deployed beyond the financial services sector.
Web Threats Shift from Botnets to URLs
McAfee continued to see suspicious URLs replacing botnets as the primary distribution mechanism for malware. An analysis of web threats found that the number of new suspicious URLs increased by 70% in Q4. New suspect URLs averaged 4.6 million per month, almost doubling the previous 2.7 million per month figure from the last two quarters. As much as 95% of these URLs were found to be hosting malware, exploits or code designed specifically to compromise computers. The decline in the number of infected systems controlled by botnet operators is driven in part by law enforcement efforts to bring botnets down, but perhaps more so by the declining appeal of the botnet business model.
Increase in Infections beneath the OS
The volume of Master Boot Record-related malware climbed 27% to reach an all-time quarterly high. These threats embed themselves deep within the computer system storage stack, where standard antivirus solutions cannot detect them. Once embedded, they can steal user information, download other malicious software, or leverage the infected PC’s computing power to launch attacks against other PCs or networks. While these MBR attacks represent a relatively small portion of the overall PC malware landscape, McAfee Labs expects them to become a primary attack vector in 2013.
Malicious Signed Binaries Circumvent System Security
The number of electronically-signed malware samples doubled over the course of Q4. This clearly indicates that cyber criminals have decided that signing malware binaries is one of the best ways to circumvent standard system security measures.
Mobile Malware Continues to Increase and Evolve
The number of mobile malware samples discovered by McAfee Labs in 2012 was 44 times the number found in 2011, meaning 95% of all mobile malware samples appeared in the last year alone. Cyber criminals are now dedicating the majority of their efforts to attacking the mobile Android platform, with an 85% jump of new Android-based malware samples in Q4 alone. The motivation for deploying mobile threats is rooted in the inherent value of the information found on mobile devices, including passwords and address books, as well as new business opportunities that are not available on the PC platform. These opportunities include Trojans that send SMS messages to premium services, then charge the user for each message sent.
The report shows continued proliferation of password-stealing trojans and advanced persistent threats (APTs) such as Operation High Roller and Project Bliztkrieg, and the expansion of their attacks to government, manufacturing and commercial transaction infrastructure targets.
Earlier, such attacks were targeted at the financial services industry. This was a part of 'McAfee Threats Report: Fourth Quarter 2012,' which was released today.
More From This Section
“We are seeing attacks shifting into a variety of new areas, from factories, to corporations, to government agencies, to the infrastructure that connects them together,” said Vincent Weafer, senior vice president of McAfee Labs. “This represents a new chapter in cyber security in that threat-development, driven by the lure of financial industry profits, has created a growing underground market for these cybercrime weapons, as well as creative new approaches to thwarting security measures common across industries.”
In Q4 2012, McAfee Labs identified the following trends:
More Threats, More Availability, More Industries Targeted
As a group, unique password-stealing trojans grew 72% in fourth quarter (Q4) as cyber criminals realised that user authentication credentials constitute some of the most valuable intellectual property stored on most computers. Now widely available, these trojans are increasingly appearing within customised threats or combined with other “off-the-shelf” threats available on the internet. Revelations in Q4 around the Citadel trojan suggest that this trojan’s information theft capabilities are being deployed beyond the financial services sector.
Web Threats Shift from Botnets to URLs
McAfee continued to see suspicious URLs replacing botnets as the primary distribution mechanism for malware. An analysis of web threats found that the number of new suspicious URLs increased by 70% in Q4. New suspect URLs averaged 4.6 million per month, almost doubling the previous 2.7 million per month figure from the last two quarters. As much as 95% of these URLs were found to be hosting malware, exploits or code designed specifically to compromise computers. The decline in the number of infected systems controlled by botnet operators is driven in part by law enforcement efforts to bring botnets down, but perhaps more so by the declining appeal of the botnet business model.
Increase in Infections beneath the OS
The volume of Master Boot Record-related malware climbed 27% to reach an all-time quarterly high. These threats embed themselves deep within the computer system storage stack, where standard antivirus solutions cannot detect them. Once embedded, they can steal user information, download other malicious software, or leverage the infected PC’s computing power to launch attacks against other PCs or networks. While these MBR attacks represent a relatively small portion of the overall PC malware landscape, McAfee Labs expects them to become a primary attack vector in 2013.
Malicious Signed Binaries Circumvent System Security
The number of electronically-signed malware samples doubled over the course of Q4. This clearly indicates that cyber criminals have decided that signing malware binaries is one of the best ways to circumvent standard system security measures.
Mobile Malware Continues to Increase and Evolve
The number of mobile malware samples discovered by McAfee Labs in 2012 was 44 times the number found in 2011, meaning 95% of all mobile malware samples appeared in the last year alone. Cyber criminals are now dedicating the majority of their efforts to attacking the mobile Android platform, with an 85% jump of new Android-based malware samples in Q4 alone. The motivation for deploying mobile threats is rooted in the inherent value of the information found on mobile devices, including passwords and address books, as well as new business opportunities that are not available on the PC platform. These opportunities include Trojans that send SMS messages to premium services, then charge the user for each message sent.