Insights from CYREN's Q2 2014 Internet Threats Trend Report

April 8, 2023 © 2014 CYREN Confidential and Proprietary

INSIGHTS FROM CYREN'S NEW Q2 TREND REPORT

© 2014 CYREN Confidential and Proprietary2

IN TODAY’S WEBINAR

Android ransomware and banking malware

The rise and fall (and rise) of Zbot

PDFs and Docs – real and unreal

Worldwide, World Cup phishing

Stock scams with Oakmont Stratton


© 2014 CYREN Confidential and Proprietary

ANDROID MALWARE TRENDS


PC RANSOMWARE


POLL – RANSOMWARE HONESTY

Do you know someone who paid the ransom? Did they get their files back? They paid and got their files back They paid and lost their files They refused to pay and lost their files They refused to pay and managed to regain access to their PC Happily I don’t know anyone who has been infected


ANDROID RANSOMWARE ARRIVES

May – “ransomware” – but no encryption

June – ransomware with encryption

AndroidOS/Simplocker.A.gen!Eldorado.


ANDROID RANSOMWARE ARRIVES

Before and after encryption Scans SD card and encrypts files like .jpg, .png, .doc amongst others


ANDROID IBANKING MALWARE

SMS/spyware – collects Text messages, Phone calls Recorded audio

Works in tandem with PC-based malware Intercepts SMS codes sent by banks

Android OS/Agent.HJ


UNKNOWN SOURCES?


NO MALWARE DETECTED

''Virus Shield'', priced at $3.99 in the Google Play store

30,000 copies in April

Does nothing


POLL: YOUR MOBILE APPS

Where do you download apps Android: The Google Play Store Android: Anywhere I can find apps iOS: Only the iTunes Store iOS: Jailbroken device – anywhere I can find apps


MALWARE TRENDS


A QUICK ZBOT HISTORY

Zeus Trojan (PC) discovered ~2007 Generally steals credentials - Banks, email,

social media Keyloggers, screenshots Sold as botnet creation kit

Zeus botnet, other botnets Distributed command and control Millions of victims 2012 – Microsoft takedown of SpyEye

Gameover Zbot Peer to peer encrypted botnet June 2014- Operation Tovar disrupted botnet July – new variants emerging…


ONE OF THE LAST ZBOT EMAILS

Attachment: Eonenergy-Bill-29052014.scr displays a PDF icon

W32/Zbot.BXN


ANOTHER ZBOT SENT USING DROPBOX


ACTUAL PDFS CAN ALSO BE PROBLEMATIC

Securedoc.pdf from BoA

Versions of reader attacked: 9.3x – 9.5x, 10.1x, 11, 11.001 (The current version is 11.0.07)


WORD DOCS TO AVOID

traking_doc_MW421330771CA.doc

aircanada_eticket_[random_number].doc

efax__[random_number].doc

file-_[random_number]_doc

President Obama’s Speech.doc


SECURITY EDUCATION POLL

Do you think people are aware that a PDF or Doc file could be harmful? Yes No


PHISHING TRENDS


WORLD CUP PHISHING

Chance to win “World-Cup” related prizes Cielo – biggest credit card provider in Brazil


GLOBAL BANK PHISHING

Global brands American Express, Bank of America, or Barclays

Country-specific Natwest (Britain) Danske Bank (Denmark) Swedbank and SEB (Sweden) Bank of India (India) Credem (Italy) Hypovereinsbank (Germany)


SPAM TRENDS


SPAM LEVELS

Spam levels continue to drop

June average is lowest in 5 years!

Q2 Average55 Billion

June Average49 Billion


Q2 SPAM TOPICS

Pharmacy Products

43%

Job Offer22%

Stock16%

Diet8%

Other4%

Online Casino3%

Phishing2% Malware

1%

Pharmacy ProductsJob OfferStockDietOtherOnline CasinoPhishingMalware


PUMP AND DUMP - RCHA

Buy: 417,000 @ 0.19

Sell: Many more @ 0.36

Profit ~$63,000


Q2 SPAM COUNTRIES, SPAM ZOMBIES

Argentina 8%

Spain 8%

Vietnam 7%

United States 6%

Germany 5%

Italy 5%Iran

4%Brazil 4%Colombia

4%Mexico

3%

Others46%


SAVING HOSTING COSTS…

Google Docs phishing email Google logo at the top stored on legitimate Internet security blog called

http://www.onlinethreatalerts.com/

http://www.onlinethreatalerts.com/


GLOBALVIEW


GLOBALVIEW CLOUD AND PRODUCT FAMILIES

WEB EMAILANTIMALWARECYREN WebSecurityURL-Filtering

MobileSecurityAntiVirus

CYREN EmailSecurityEmail Messaging SuiteAntiSpamOutbound AntiSpamIP ReputationAntiVirus for Email

GlobalViewTM Cloud


We focus on our core competencies so our partners can focus on theirs.

Technical Account ManagersPartner Success Program

COMMITTED TO PARTNER SUCCESS

WHAT MAKES US DIFFERENT



ANY QUESTIONS?

Insights from CYREN's Q2 2014 Internet Threats Trend Report

Technology

Transcript of Insights from CYREN's Q2 2014 Internet Threats Trend Report