October 26, 2010, 2:15 PM — Targeted attacks via fraudulent and dangerous e-mail are on the rise, according to a Symantec report published today. These attacks are typically aimed at corporative executives, to fool them into opening malicious attachments or links so the perpetrators can take control of desktop computers.
Spam nation: U.S. tops list of spam-producing countries
In the September/October timeframe, 77 targeted attacks per day were intercepted, compared to 60 per day in the prior month, according to the Symantec October 2010 MessageLabs Intelligence Report, which is based on Symantec's e-mail filtering and analysis. For the first time, the retail sector is the hardest hit industry, rising from fewer than .5% of all attacks over the past two years to about 25% in the past month.
"The targets are widening from large international organizations to small- to mid-sized businesses," says Paul Wood, senior analyst within Symantec's MessageLabs Intelligence division. "The spike that stood out is in the retail sector, where we haven't seen that before." Targeted attacks have been far more common against the public sector and the pharmaceutical industry, for instance, he notes.
Worst moments in network security history
Wood compares targeted attacks to "sniper warfare." Attackers send legitimate-looking e-mail that appears to be from the human resources or IT staff, for example, to go after what the attackers hope are high-value targets.
In many cases, the goal may be to gain intelligence about company operations. The latest round in particular seems to be "a competitive type of attack" to gain information that could be of use to a competitor, says Wood, who speculates that "it's an industrial espionage sort of thing."
Unlike broader blasts of spam that can also contain dangerous attachments and links, targeted e-mail attacks are far smaller in volume. In the past month, the targeted e-mail attacks that Symantec detected and blocked were aimed at 286 organizations in total, went after six retail companies, and included 516 separate spear phishing attacks that appear to have originated from IP addresses in the U.S. and Argentina.
Two retail organizations in particular were the target of 63% of these 516 attacks. When the first round of attack e-mail was blocked, second and third rounds kept coming. In one case the attack spoofed an organization's senior IT security executive to target 70 employees by fraudulently requesting action with a "critical update" that was actually a malicious attachment. If a recipient had clicked on it, a backdoor Trojan would have been installed on the machine, giving the attacker access to it, Symantec says.
Read more about wide area network in Network World's Wide Area Network section.
