Related Stories

  • ZeroAccess is top bot in home networks
    When it comes to buggy home LANs in the US, the rate of home network infections actually decreased from 13% to 11% in the fourth quarter of 2012 – translating to about one in 10 households. But out of that, 6% exhibited high-level threats, such as bots, rootkits and banking trojans, while moderate-level threats included spyware, browser hijackers and adware.
  • Banking trojans change up their tactics
    Two high-profile banking trojans, Tinba and Tilon, are manifesting simultaneous changes designed to avoid detection by financial security systems. Instead of tampering with an online banking session in real time, both are now serving fake web pages to capture credentials – a distinctly remedial approach, researchers say.
  • Mischiefware remains the primary threat to the mobile user
    The Blue Coat 2013 Mobile Malware Report draws its data from 75 million users worldwide, and provides a detailed overview of the current mobile threat.
  • Red October cyber-espionage campaign used highly sophisticated infiltration techniques
    Red October (Rocra), the high-level cyber-espionage campaign that successfully infiltrated computer networks at diplomatic, governmental and scientific research organizations worldwide, has a more shadowy persona than the typical APT, security researchers said.
  • Red October analysis reveals complex, two-stage attack
    In the wake of the discovery of Red October, a complex, in-depth cyber-espionage campaign going back at least five years, security researchers have published a comprehensive analysis of the breadth and depth of the operation, uncovering a two-pronged attack methodology.

Top 5 Stories


Sophisticated banking threats branch out to other sectors – and get smarter

21 February 2013

Sophisticated cyber-attacks originally targeting the financial services industry are now increasingly directed at other critical sectors of the economy, a new threat report finds, adding that there is also fresh cause for concern: the attackers are getting smarter.

The McAfee Threats Report, Fourth Quarter 2012, has uncovered an emerging set of new tactics and technologies are being implemented to evade industry-standard security measures, even as password-stealing trojans and advanced persistent threats (APTs) are expanding their attacks to government, manufacturing and commercial transaction infrastructure targets. 

“We are seeing attacks shifting into a variety of new areas, from factories, to corporations, to government agencies, to the infrastructure that connects them together,” said Vincent Weafer, senior vice president of McAfee Labs, in a statement announcing the report. “This represents a new chapter in cybersecurity in that threat-development, driven by the lure of financial industry profits, has created a growing underground market for these cybercrime weapons, as well as creative new approaches to thwarting security measures common across industries.”

For instance, the security firm found that the volume of Master Boot Record-related malware climbed 27% to reach an all-time quarterly high. These threats embed themselves deep within the PC system storage stack, where standard anti-virus solutions cannot detect them. Once embedded, they can steal user information, download other malicious software or leverage the infected PC’s computing power to launch attacks against other PCs or networks. While these MBR attacks represent a relatively small portion of the overall PC malware landscape, McAfee Labs expects them to become a primary attack vector in 2013.

Also, the number of electronically signed malware samples doubled over the course of Q4. “This clearly indicates that cybercriminals have decided that signing malware binaries is one of the best ways to circumvent standard system security measures,” McAfee said.

The report findings coalesce into a few areas, all under the theme of greater sophistication than what we’ve seen in the past. As a group, unique password-stealing trojans grew 72% in Q4 as cybercriminals realized that user authentication credentials constitute some of the most valuable intellectual property stored on most computers. Now widely available, these trojans are increasingly appearing within customized threats or combined with other “off-the-shelf” threats available on the internet. Fourth quarter revelations around the Citadel trojan suggest that this trojan’s information theft capabilities are being deployed beyond the financial services sector, McAfee noted.

McAfee said is also continues to see suspicious URLs replacing botnets as the primary distribution mechanism for malware. An analysis of web threats found that the number of new suspicious URLs increased by 70% in Q4.

New suspect URLs averaged 4.6 million per month, almost doubling the previous 2.7 million per month figure from the last two quarters. A full 95% of these URLs were found to be hosting malware, exploits or code designed specifically to compromise computers.

“The decline in the number of infected systems controlled by botnet operators is driven in part by law enforcement efforts to bring botnets down, but perhaps more so by the declining appeal of the botnet business model,” McAfee noted.

On the mobile malware front, the story is the same one that we have seen develop across industry reports. The number of mobile malware samples discovered by McAfee Labs in 2012 was 44 times the number found in 2011, meaning 95% of all mobile malware samples appeared in the last year alone.

“Cybercriminals are now dedicating the majority of their efforts to attacking the mobile Android platform, with an 85% jump of new Android-based malware samples in Q4 alone,” McAfee said. “The motivation for deploying mobile threats is rooted in the inherent value of the information found on mobile devices, including passwords and address books, as well as new business opportunities that are not available on the PC platform.”

Those opportunities include trojans that send SMS messages to premium services, then charge the user for each message sent.

This article is featured in:
Industry News  •  Internet and Network Security  •  IT Forensics  •  Malware and Hardware Security  •  Wireless and Mobile Security


Comment on this article

You must be registered and logged in to leave a comment about this article.

We use cookies to operate this website and to improve its usability. Full details of what cookies are, why we use them and how you can manage them can be found by reading our Privacy & Cookies page. Please note that by using this site you are consenting to the use of cookies. ×