SophosLabs Research Finds “Designer” Cyber Threats on the Rise

Sophos Press Release

OXFORD, U.K., May 3, 2016 – Sophos (LSE: SOPH), a global leader in network and endpoint security, today revealed SophosLabs research that indicates a growing trend among cybercriminals to target and even filter out specific countries when designing ransomware and other malicious cyberattacks. The research includes information from millions of endpoints worldwide and is analyzed by the team at SophosLabs.

To lure more victims with their attacks, cybercriminals are now crafting customized spam to carry threats using regional vernacular, brands and payment methods for better cultural compatibility, according to Sophos. Ransomware cleverly disguised as authentic email notifications, complete with counterfeit local logos, is more believable, highly clickable and therefore more financially rewarding to the criminal. To be as effective as possible, these scam emails now impersonate local postal companies, tax and law enforcement agencies and utility firms, including phony shipping notices, refunds, speeding tickets and electricity bills. SophosLabs has seen a rise in spam where the grammar is more often properly written and perfectly punctuated.

"You have to look harder to spot fake emails from real ones," said Chester Wisniewski, senior security advisor at Sophos. "Being aware of the tactics used in your region is becoming an important aspect of security."

Researchers also saw historic trends of different ransomware strains that targeted specific locations. Versions of CryptoWall predominantly hit victims in the U.S., U.K., Canada, Australia, Germany and France, TorrentLocker attacked primarily the U.K., Italy, Australia and Spain and TeslaCrypt honed in on the U.K., U.S., Canada, Singapore and Thailand.

The analysis also shows Threat Exposure Rates[1] (TER) for countries during the first three months of 2016. Although Western economies are more highly targeted, they typically have a lower TER. Nations ranked with the lowest TER include France at 5.2 percent, Canada at 4.6 percent, Australia at 4.1 percent, the U.S. at 3 percent, and the U.K. at 2.8 percent. Algeria at 30.7 percent, Bolivia at 20.3 percent, Pakistan at 19.9 percent, China at 18.5 percent and India at 16.9 percent are among countries with the highest percentage of endpoints exposed to a malware attack.

"Even money laundering is localized to be more lucrative. Credit card processing can be risky for criminals, so they started using anonymous Internet payment methods to extort money from ransomware victims," said Wisniewski. "We have seen cybercrooks using local online cash-equivalent cards and purchasing locations, such as prepaid Green Dot MoneyPak cards from Walgreens in the U.S. and Ukash, which is now paysafecard, from various retail outlets in the U.K."

Tweet: Tweet this: "Designer" cyber threats on the rise with localized logos, language and payment methods, according to Sophos.

The concept of filtering out specific countries has also emerged as a trend.

"Cybercriminals are programming attacks to avoid certain countries or keyboards with a particular language," said Wisniewski. "This could be happening for many reasons. Maybe the crooks don’t want attacks anywhere near their launch point to better avoid detection. It could be national pride or perhaps there’s a conspiratorial undertone to create suspicion about a country by omitting it from an attack."

Banking is an example of how cybercriminals are using location-based malware to be more prosperous. Sophos research reveals historically how Trojans and malware used to infiltrate banks and financial institutions converges on specific regions:

  • Brazilian banker Trojans and variants pinpoint Brazil
  • Dridex is predominant in the U.S. and Germany
  • Trustezeb is most prevalent in German speaking counties
  • Yebot is popular in Hong Kong and Japan
  • Zbot is wider spread, but mostly in the U.S., U.K., Canada, Germany, Australia, Italy, Spain and Japan

"There is an entire cottage industry of uniquely-crafted Trojans just targeting banks in Brazil," said Wisniewski.

With cybercriminals having a deliberate hand in creating threats that look authentic and are specifically targeted, it is more difficult to recognize malicious spam. Home computer users are often a target of these attacks and should protect their systems from sophisticated malware threats. Free enterprise-grade security software that can detect threats and protect both Mac and PC for the home user is available from Sophos Home.

This research and analysis is from SophosLabs, a network of security experts across the world who detect and track all types of Internet breaches 24/7/365 worldwide, including computer viruses, advanced malware and Trojans, spam, web threats, hack attacks and more. SophosLabs receives and investigates millions of emails, URLs, files and other data points daily and leverages its extensive expertise within the group to develop new definitions that detect entire classes of threats and new variants. With facilities strategically located in Australia, Hungary, U.K., and Canada, SophosLabs experts also monitor and determine threat trends and maintain malware, spam and web threat dashboards in real time. For more information and graphics please visit the Sophos News Blog.

[1] TER data represents malware infections and attacks per 1,000 Sophos endpoints in each country, Jan. 1 2016 to April 8, 2016.

Acerca de Sophos

Sophos, líder mundial en ciberseguridad next-gen, protege a más de 400 000 empresas de todos los tamaños en más de 150 países de las ciberamenazas más avanzadas de la actualidad. Gracias al respaldo de SophosLabs, un equipo global de ciencia de datos e información sobre amenazas, las soluciones con IA y nativas en la nube de Sophos protegen endpoints (portátiles, servidores y dispositivos móviles) y redes contra las técnicas de ciberataque en evolución, como el ransomware, el malware, los exploits, la exfiltración de datos, las intrusiones de adversarios activos y el phishing, entre otras. Sophos Central, una plataforma de administración nativa en la nube, integra todo el catálogo de productos next-gen de Sophos, incluidos la solución para endpoints Intercept X y el firewall next-gen XG, en un único sistema de “Seguridad Sincronizada” accesible a través de una serie de API. Sophos ha estado impulsando una transición a la ciberseguridad next-gen, aprovechando las capacidades avanzadas de la nube, el Machine Learning, las API, la automatización y la respuesta administrada a las amenazas, entre otras, a fin de ofrecer una protección de nivel empresarial a empresas de todos los tamaños. Sophos vende sus productos y servicios exclusivamente a través de un canal global de más de 53 000 partners y proveedores de servicios administrados (MSP). Asimismo, Sophos pone a disposición de los usuarios particulares sus innovadoras tecnologías comerciales a través de Sophos Home. La empresa tiene su sede en Oxford, Reino Unido. Encontrará más información en es.sophos.com