Crimeware production surged in the second half of 2010, according to the APWG, which said one of its contributing companies recorded more than 10 million new malware samples during those months.
Meanwhile, attacks have evolved to a new level, with some now taking the form of several components that arrive in an infected machine at different times before acting together as one malicious code to break into consumer banking accounts and make illicit transfers or bogus bill payments, the APWG said.
Still, “55% of the new samples created in the second half of 2010 were Trojans, the favorite weapon used by cybercriminals to infect consumers’ computers,” said Louis Corrons, technical director at PandaLabs and a contributor to the trade group’s just-released H2 2010 Phishing Activity Trends Report.
Corrons’ company reported 10,425,663 new malware samples in the last six months of last year, representing 17% of all samples PandaLabs has recorded since 1990, he said.
The shift in tactics also was noted in the report.
“During the second half of 2010 we saw a small drop, percentage-wise, in malware aimed specifically at stealing data but an increase in the total amount of samples compared to the first half of 2010. Downloaders are used in many of these cases and the end goal is still to steal data – but using several components instead of including this functionality in the main component," said Patrik Runald, senior manager of security research at Websense.
The APWG also noted an increase in spear-phishing – highly individualized attacks on insiders at companies and government agencies – and blamed that tactic for some of the mostly costly hack attacks reported so far.
“These emails usually evade spam and anti-virus filters, and are very effective at infecting a user's computer,” said Dave Jevans, APWG chairman. “This trend is accelerating in 2011, and is responsible for many high-profile corporate data breaches.”
The APWG is a coalition of security, financial services and government organizations founded in 2003 as the Anti-Phishing Working Group.
