Font Size: A A A

Home > News > Case Studies > Lab report

Case Studies

Lab report

A bi-annual report from M86 Security Lab highlights the tactics and trends employed by cybercriminals between June to December 2011, as tracked by the malware researchers in the Labs. M86 Security details a significant growth in cybercrime, via sophisticated targeted attacks and social media scams, as well as a rise in malicious email attachments, despite a four-year low in spam volumes last year.  

Investigating the web and email threat trends in the second half of 2011, M86 Security Labs analysed spam and malware activity, including the current use of exploit kits, fraudulent digital certificates and social networking schemes, and tracked global Internet security trends. The Labs noted that while spam levels have declined, the proportion of malicious spam has increased from one per cent to 5pc in the last half of the year.

“We already know that cybercriminals have become adept at circumventing mainstream security solutions, and as we find more fraud perpetrated through social networking sites and mobile devices, it is imperative for organizations to educate their users and complement their reactive protection with proactive, real-time technologies to enhance their security posture,” said Bradley Anstis, Vice President of Technical Strategy, M86 Security. “Many of the trends we forecast, such as the increased use of stolen digital certificates in targeted attacks, have occurred. Our goal is to help organisations pre-empt these complex attacks before malware has a chance to infiltrate networks and cause very real damage.”

Key findings for the second half of 2011:

Critical national infrastructure is targeted

As targeted attacks become more sophisticated, cybercriminals are pursuing a wider range of organisations, including commercial, national critical infrastructure and military targets. Confirmed attacks in 2011 include RSA, Lockheed Martin and the Asia-Pacific Economic Cooperation (APEC). Dutch company DigiNotar, for example, detected an intrusion that resulted in the fraudulent issuance of hundreds of digital certificates for a number of domains, including Google, Yahoo, Facebook, the CIA, the British MI6 and the Israeli Mossad.

Stolen digital certificates are increasingly used in successful targeted attacks

Stealing or faking digital certificates has become an important component of a targeted attack. Digital certificates are used to confirm and assure a user that the downloaded application truly is from the trusted vendor. With stolen certificates, cyber-criminals can distribute malware and sign it with a legitimate company certification, thus tricking users to confidently download the application.

The Blackhole exploit kit dominates the exploit kits market

In late 2011, Blackhole established itself as the most successful exploit kit. Its authors increased its update frequency and added new ways to evade detection, such as checking the software version on the client machine before attempting to exploit it.

The volume of malicious spam escalated in 2011

Though overall spam volume decreased as of December 2011, the proportion of malicious spam rose in the second half of the year from less than 1pc to 5pc, with a spike in malicious attachments occurring in August and September. As noted previously, there was a shift from malicious attachments to the use of embedded links to infected content later in the year.

Social media is a haven for fraudulent posts and scams

It is now mainstream practice for spammers to use bogus social media notifications to dupe users into clicking on infected links. Perhaps even more troubling is the success with which cybercriminals capitalise on user trust and familiarity to make Facebook, for example, a conduit for spam and malware propagation. Many of these campaigns are spread virally by enticing users to share posts for “rewards” or “gift cards” with their friends.  

The complete version of the latest M86 Security Labs Report, can be downloaded directly at:


Related News