Sophos

Talk to our experts

Find your local press contact

Resources

Sophos blogs

Info feeds

What are info feeds?

31 January 2007

Dorf malware storms the top ten chart Sophos announces top ten threats and hoaxes reported in January 2007

Sophos, a world leader in IT security, has revealed the most prevalent malware threats and email hoaxes causing problems for computer users around the world during January 2007.

The figures, compiled from Sophos's global network of monitoring stations, show that the recently discovered Dorf malware has had a massive impact on computer users worldwide, rampaging to the top of the monthly malware threat chart and accounting for almost 50 percent of all malware seen during January.

The Dorf malware was aggressively spammed out posing as breaking news of deaths caused by stormy European weather during January. Later in the month the authors changed tack and launched a further campaign disguising the malware as a romantic email greeting card. Elsewhere in the top ten, the Netsky, Mytob and Stratio malware remain rooted in second, third and fourth place respectively, between them accounting for one third of all malware reports.

The top ten list of malware threats in January 2007 reads as follows:

Position Last
month
Malware Percentage of reports
1NewDorf
   46.1%
22Netsky
   16.1%
33Mytob
   9.8%
44Stratio
   8.5%
55Zafi
   3.6%
67MyDoom
   2.8%
78Sality
   2.6%
85Bagle
   2.5%
99Nyxem
   1.0%
10NewWukill
   0.8%
Others 6.2%

"Spammed out with hard-hitting headlines and the promise of exclusive news content, the Dorf malware, or 'Storm Trojan', moved at gale force speeds and battered inboxes worldwide in an attempt to compromise users' PCs," said Carole Theriault, senior security consultant at Sophos. "Though not a particularly sophisticated form of attack, preying upon public interest by using breaking news events is a tried and trusted trick. It has proven to be a remarkably effective method of fooling recipients into lowering their guard."

Sophos has so far seen more than 2500 variants of the Dorf malware - almost a third of the new threats identified during January 2007. The majority of these variants were intercepted by Sophos's proactive Behavioral Genotype® Protection technology even before they were formally identified as belonging to the Dorf family of malware.

The proportion of infected email, while substantially higher than in December 2006, is still small at just one in 238 (0.42%), while during January Sophos identified 7,272 new threats, bringing the total number of malware protected against to 214,956.

The top ten hoaxes and chain letters in January 2007 were as follows:

Position Hoax Percentage of reports
1Hotmail hoax
   28.8%
2Olympic torch
   16.9%
3Justice for Jamie
   3.1%
4Budweiser frogs screensaver
   2.9%
5A virtual card for you
   2.9%
6Bonsai kitten
   2.5%
7Applebees Gift Certificate
   1.7%
8Meninas da Playboy
   1.7%
9Bill Gates fortune
   1.4%
10MSN is closing down
   1.3%
Others36.8%

Graphics of the above top ten malware chart are available.

The Sophos Security Threat Report 2007, which discusses 2006's most prevalent families of malware and malware hosting countries in more detail, can be downloaded from the Sophos website:

  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

About Sophos

More than 100 million users in 150 countries rely on Sophos as the best protection against complex threats and data loss. Sophos is committed to providing security and data protection solutions that are simple to manage, deploy and use and that deliver the industry's lowest total cost of ownership. Sophos offers award-winning encryption, endpoint security, web, email, and network access control solutions backed by SophosLabs - a global network of threat intelligence centers. With more than two decades of experience, Sophos is regarded as a leader in security and data protection by top analyst firms and has received many industry awards.

Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.

See also: