Email Threats 2017
Total Page:16
File Type:pdf, Size:1020Kb
Internet Security Threat Report ISTR Email Threats 2017 An ISTR Special Report Analyst: Ben Nahorney October 2017 Contents Executive summary and key findings Malware Spambots BEC scams Spam User email behavior Protection and best practices Internet Security Threat Report Contents 3 Executive summary and key findings 5 Big numbers 7 Malware 8 Impact 9 Malware distribution 11 Spambots 12 Necurs 12 BlankSlate 12 Fioesrat 13 Silentbrute 13 Pandex 13 Oliner 13 Sarvdap 13 Emotet 13 Waledac 14 BEC scams 15 Latest trends 16 Beyond wire transfers 16 Typosquatting 16 Phishing Figures and Tables 16 Phishing scams of note 8 Email users targeted by malware per month 17 Spam 8 Percent of email users targeted by malware by industry 18 Advertising spam 9 Top three malicious email themes 19 Other distribution methods 10 Downloader detections by month 19 The cost of spam 10 URL malware rate 12 Necurs botnet activity 21 User email behavior 13 Waledac (Kelihos) botnet activity 23 Protection and best practices 15 BEC emails received per organization 24 Email security 15 Top subject lines in BEC scam emails 24 CloudSOC 16 Phishing rate 24 Download Insight 18 Spam rate by half year 24 Advanced antivirus engine 18 Spam campaign advertising pharmaceuticals 24 SONAR behavior engine 19 Bitcoin scam email 24 Ongoing development 19 Example Tofsee email 25 Best practices 19 The website Tofsee email links to 26 About Symantec 22 Broadly shared emails with sensitive information 26 More Information 22 Number of registered TLS email domains Internet Security Threat Report Executive summary and key findings Section 00 00 Executive summary and key findings Page 4 Email Threats 2017 Executive summary Key findings Email is everywhere. In its 40-plus-year | An email user is almost twice as likely to encounter history, email has become one of the most malware through email than they are through the next-most common infection method, exploit kits. ubiquitous electronic technologies to date, with billions of messages sent each day. | One out of every nine email users encountered email malware in the first half of 2017. With that level of popularity comes its share of risks. Email is by | Approximately 8,000 businesses each month are targeted far the most popular method for attackers to spread malicious by BEC scams. code. At present, a user is almost twice as likely to encounter malicious code through email than being impacted by an exploit | A targeted organization has 5.2 BEC emails sent to them kit. They are many more times as likely to encounter a malicious in a given month. email than see their devices fall prey to a worm or encounter a | The spam rate for the first half of 2017 reached 54 malicious banner ad. On average, one out of every nine email percent, and is expected to continue to climb as the year users has encountered email malware in the first half of 2017. progresses. Malicious code is not the only threat utilizing email. With their | Without spam filters, a business effectively employs two heavy reliance on social engineering, and their urgent nature, people to manage spam for every 100 employees. business email compromise BEC scams are one of the more potent email attacks making the rounds. No longer do such attacks appear to be a rarity either, with approximately 8,000 businesses reporting attacks in a given month. On average a targeted organization has 5.2 BEC emails sent to them each month. Spam continues to represent a vast proportion of email traffic, increasing to 54 percent of email in the first half of 2017, after the rate had appeared to bottom out over the last two years. The importance of filtering spam has never been more important, where not doing so can cost businesses the equivalent of employing multiple people just to manage that spam. The risks found in email are not evenly distributed either. Attackers appear to be targeting certain businesses at higher rates than others. Some industries are particularly targeted, often seeing threat rates twice as high as the overall average. While most of these threats come from outside an organization, it’s equally important to protect outgoing email. Our findings indicate that more could be done on this front in order to ensure sensitive data sent by email is protected, thus avoiding the exposure of private information. Email continues to play a vital role in our electronic lives, but so too does it play a vital role in the distribution of threats. It’s as important as ever to understand email’s part in the threat landscape and what can be done to protect yourself and your business from them. Back to Table of Contents Internet Security Threat Report Big numbers Section 01 Email01 Big numbers Threats 2017Page 6 Email Threats 2017 The Big Numbers Malware One out of nine email users encountered email malware in the first half of 2017. 2x A user is almost twice as likely to encounter malware through email than they are through exploit kits. BEC scams Approximately 8,000 businesses each month are targeted by BEC scams. A targeted organization is sent 5 BEC emails in a given month. Spam The spam rate reached 54 percent, and is expected to continue to climb as the year progresses. 54% 2015 H1 2015 H2 2016 H1 2016 H2 2017 H1 2017 H2 (estimated) Without spam filters, a business effectively employs two people to manage spam for every 100 employees. Back to Table of Contents Internet Security Threat Report Malware Section 02 02 Malware Page 8 Email Threats 2017 Email is the most frequently used delivery Email users targeted by malware per month mechanism for malware. According to research Users Targeted (1 in) we conducted across different threat vectors, 2 no other distribution channel comes close: not 4 compromised websites containing exploit kits, not 6 7 7 network file sharing technologies like SMB, not 8 9 10 malicious advertising campaigns that entice users 10 12 11 to click on banner ads. In fact, a user is almost 12 twice as likely to encounter malware through 14 16 email than come across a malicious website. JAN F M A M J 2017 The strengths that have made email such a popular communication tool are the same reasons cyber Depending on the industry that a given user works within, this number could rise even higher. The percentage of users criminals use it to spread their wares. The attackers that will have a malicious email sent to them climbs as high as just fire off a spam message to a target, or group of 23.8 percent in industries such as Wholesale Trade and 22.6 targets, and that’s it—no need to rely on indirect percent in Mining. It’s 18.4 percent in Agriculture, Forestry, & methods where the target might or might not visit Fishing and more than 18.2 percent in Manufacturing. a compromised site or click a malicious banner ad. It is a direct channel to an end user who, if they Percent of email users targeted by malware by industry can be convinced to open an attachment or click a link in the email, can cut a large swath through Users that had malicious emails Industry a variety of network security layers, gaining sent to them (%) an attacker access to their intended target. Wholesale Trade 23.8 Mining 22.6 Impact Nonclassifiable Establishments 20.3 This direct access to the intended target is reason alone to Agriculture, Forestry, & Fishing 18.4 get businesses to take malicious email seriously. Businesses are regularly targeted by malicious emails. In fact, in the first Manufacturing 18.2 half of 2017, more than 11 percent of users had at least one Public Administration 16.9 malicious email sent to them. That’s one out of every nine Retail Trade 14.4 email users. Construction 12.9 This figure trended upward as the year progressed. In January, only one out of every 12 users (8.6 percent) had a malicious Services 9.5 email sent to them. By May this number had climbed to more Transportation & Public Utilities 7.2 than one in seven (15 percent) and remained at that level through June. Yet regardless of the level, it only takes one user Finance, Insurance, & Real Estate 6.8 to fall victim to an attack, and the business has been compro- mised. Back to Table of Contents 02 Malware Page 9 Email Threats 2017 Malware distribution The vast majority of malicious emails attempt to entice the user through socially engineered subject lines and message bodies in order to trick the user into opening a malicious Typical email malware attachment. While the subject matter varied, the top three themes centered around billing, package delivery, and scanned infection process: documents—all topics where an email attachment wouldn’t appear out of the ordinary. Top three malicious email themes 01 An attacker sends an Topic Percentage of malicious emails email, typically masquerading as an Bill or Invoice 9.2 INVOICE, DELIVERY, or DOCUMENT SCAN Package Delivery 9.1 Scanned Documents 8.4 There are generally two ways malicious code is distributed by The email contains an email—either by a URL in the message body or an email attach- 02 attachment, usually a ment. Email attachments continue to be the most popular way JavaScript (JS) file or an to deliver malicious code. In the first half of 2017, 74 percent office file containing a of malicious emails distributed their payload through email macro attachments, though at times during that period the rate was closer to 85 percent. Now the payload in-and-of-itself wasn’t necessarily attached to the email directly.