Intelligence Report June 2015

SYMANTEC INTELLIGENCE REPORT
JUNE 2015
2 | June 2015
Symantec Intelligence Report
3 Summary
4
June in Numbers
5
Targeted Attacks & Phishing
5
5
6
6
7
Top 10 Industries Targeted in Spear-Phishing Attacks

Spear-Phishing Attacks by Size of Targeted Organization
Phishing Rate
Proportion of Email Traffic Identified as Phishing by Industry Sector
Proportion of Email Traffic Identified as Phishing by Organization Size
8
Vulnerabilities
8
8
9
Total Number of Vulnerabilities

Zero-Day Vulnerabilities
Vulnerabilities Disclosed in Industrial Control Systems
10
Malware
10
10
11
11
12
12
13
13
New Malware Variants

Top 10 Mac OSX Malware Blocked on OSX Endpoints
Ransomware Over Time
Crypto-Ransomware Over Time
Proportion of Email Traffic in Which Malware Was Detected
Percent of Email Malware as URL vs. Attachment by Month
Proportion of Email Traffic Identified as Malicious by Industry Sector
Proportion of Email Traffic Identified as
Malicious by Organization Size
14
Mobile & Social Media
14
14
15
Android Mobile Malware Families by Month

New Android Variants per Family by Month
Social Media
16
Spam
16
16
17
Overall Email Spam Rate

Proportion of Email Traffic Identified as Spam by Industry Sector
Proportion of Email Traffic Identified as Spam by Organization Size
18 About Symantec
18 More Information
Welcome to the June edition of the Symantec

Intelligence report. Symantec Intelligence aims
to provide the latest analysis of cyber security
threats, trends, and insights concerning malware,
spam, and other potentially harmful business
risks.
Symantec has established the most comprehensive
source of Internet threat data in the world through
the Symantec Global Intelligence Network,
which is made up of more than 57.6 million attack
sensors and records thousands of events per
second. This network monitors threat activity
in over 157 countries and territories through a
combination of Symantec products and services
such as Symantec DeepSight Intelligence,
Symantec Managed Security Services, Norton
consumer products, and other third-party data
sources.
3 | June 2015
Summary
There is good news this month on the email-based front of the threat landscape. According
to our metrics, the overall spam rate has dropped to 49.7 percent. This is the first time this
rate has fallen below 50 percent of email for over a decade. The last time Symantec recorded
a similar spam rate was clear back in September of 2003.
Phishing rates and email-based malware were also down this month. However, there were
57.6 million new malware variants created in June, up from 44.5 million pieces of malware
created in May and 29.2 million in April. This increase in activity lends more evidence to the
idea that, with the continued drops in email-based malicious activity, attackers are simply
moving to other areas of the threat landscape.
Ransomware attacks are up in June, with over 477,000 detected during the month. While
still below the levels seen at the end of 2014, this is the second month in a row ransomware
attacks have increased since they reached a 12-month low in April. Crypto-ransomware is
also up in June, reaching the highest levels seen since December 2014.
In other news, after a busy month in May targeted attacks against the Manufacturing
industry leveled out in June, dropping from 41 percent to 22 percent. Manufacturing still
comes out on top in terms of sectors subject to targeted attacks, but activity is now in line
with what is being seen in the Finance, Insurance, & Real Estate sector and the Services
Professional sector, which come in at second and third place.
We hope that you enjoy this months report and feel free to contact us with any comments or
feedback.
Ben Nahorney, Cyber Security Threat Analyst
symantec_intelligence@symantec.com
4 | June 2015
JUNE IN NUMBERS
5 | June 2015
Targeted Attacks & Phishing

The Manufacturing sector
June
May
22%
Manufacturing
17
15
Finance, Insurance, & Real Estate

Services - Professional
17
Transportation, Communications,
Electric, Gas, & Sanitary Services
12
6
9
8
Services - Non Traditional
Wholesale
Construction
Nonclassifiable Establishments
Retail
Mining
41
was targeted with the greatest

volume of spear-phishing
attacks in June, as 22 percent
were directed at manufacturing
organizations.
<1
2
2
2
2
<1

Source: Symantec

Large enterprises were the target
Company Size
June
May
1-250
38.1%
42.5%
251-500
15.2%
5.1%
501-1000
9.0%
6.6%
1001-1500
9.9%
2.7%
1501-2500
2.7%
3.9%
2501+
25.1%
39.2%

Source: Symantec
of 25.1 percent of spear-phishing

attacks in June, down from 39.2
percent in May. In contrast, 38.1
percent of attacks were directed
at organizations with less than
250 employees.
6 | June 2015
The overall phishing rate has
400
decreased slightly this month,

where one in 2,448 emails was a
phishing attempt.
1004
1200 1290
1 IN
647
800
1600
J
2015
1465
1610
1587
2000
1517
2057
1865
2041
2400
2448
2666
2800
Phishing Rate
Inverse Graph: Smaller Number = Greater Risk
Source: Symantec
Phishing Rate
The Agriculture, Forestry, &
Industry
June
May
Agriculture, Forestry, & Fishing
1 in 1,469.9
1 in 856.0
Public Administration
1 in 2,367.3
1 in 1,289.3
1 in 2,750.3
1 in 1,762.2
1 in 2,753.1
1 in 1,834.9
Finance, Insurance & Real Estate
1 in 2,901.7
1 in 1,349.9
Construction
1 in 3,003.1
1 in 2,124.9
Mining
1 in 3,120.1
1 in 2,230.6
1 in 3,977.5
1 in 2,408.2
Wholesale
1 in 4,142.5
1 in 2,878.2
1 in 4,495.4
1 in 2,840.2
Proportion of Email Traffic Identified as Phishing

by Industry
SectorTraffic Identified as Phishing by Industry Sector
Proportion
of Email
Source: Symantec.cloud
Fishing sector was once again the

most targeted Industry overall
for phishing attempts in June,
where phishing comprised one in
every 1,470 emails. This rate was
higher than any other industry in
either May or June.
7 | June 2015
Small companies with less than
Company Size
June
May
1250
1 in 1,552.5
1 in 1,473.9
251500
1 in 2,553.7
1 in 1,629.5
5011000
1 in 3,051.4
1 in 1,940.9
10011500
1 in 3,443.2
1 in 1,988.9
15012500
1 in 3,552.6
1 in 2,032.8
2501+
1 in 3,624.5
1 in 2,280.8
Proportion of Email Traffic Identified as Phishing

by Organization Size
Proportion
of Email Traffic Identified as Phishing by Organization Size
250 employees were again the

most targeted organization size
in June.
8 | June 2015
Vulnerabilities
The number of vulnerabilities
declined in June, down from 579

in May to 526 vulnerabilities
reported during the month.
700
600
600
575
596
500
562
457
399
400
428
540
471
469
579
526
300
200
100
J
2015

Source: Symantec

There was a one zero-day
vulnerability discovered in May,

the Adobe Flash Player CVE2015-3113 Unspecified Heap
Buffer Overflow Vulnerability.
0
O
Source: Symantec
0
D
J
2015
9 | June 2015
While two vulnerabilities in
12
10
10
12
Vulnerabilities
10
Unique Vendors
2
1
2
1
2
0
0
J
J
2015

Source: Symantec

Methodology
In some cases the details of a vulnerability are not publicly disclosed during the same month that it
was initially discovered. In these cases, our vulnerability metics are updated to reflect the time that
the vulnerability was discovered, as opposed to the month it was disclosed. This can cause fluctuations in the numbers reported for previous months when a new report is released.
industrial control systems were

reported by one vendor in April,
none were reported in May or
June.
10 | June 2015
Malware
There were more than 57.6
million new pieces of malware

created in June, up from 44.5
million created in May.
63.6
MILLIONS
57.6
44.7
28.2
31.7
35.9
44.5
26.6
35.8
33.7
29.2
26.5
J
2015

Source: Symantec
OSX.RSPlug.A continues to be
Malware Name
June
Percentage
Malware Name
May
Percentage
OSX.RSPlug.A
29.5%
OSX.RSPlug.A
23.9%
OSX.Keylogger
11.6%
OSX.Keylogger
14.0%
OSX.Klog.A
8.9%
OSX.Wirelurker
9.0%
OSX.Luaddit
7.8%
OSX.Luaddit
8.3%
OSX.Wirelurker
7.1%
OSX.Klog.A
8.0%
OSX.Flashback.K
5.4%
OSX.Flashback.K
6.4%
OSX.Stealbit.B
4.3%
OSX.Netweird
3.9%
OSX.Freezer
3.2%
OSX.Sabpab
3.8%
OSX.Netweird
2.9%
OSX.Stealbit.B
3.6%
10
OSX.Okaz
2.5%
OSX.Flashback
3.0%
Rank
Top 10 Mac OS X Malware Blocked on OS X Endpoints

Source: Symantec
Top 10 Mac OSX Malware Blocked on OSX Endpoints
the most commonly seen OS X

threat seen on OS X endpoints in
June, up 5.6 percentage points
from May.
11 | June 2015
Ransomware attacks were up in
800
700
734
673
669
693
738
June for the second month in a

row, where over 477 thousand
attacks were detected.
756
THOUSANDS
600
544
477
500
399
400
354
300
248
297
200
100
J
2015

Source: Symantec
Crypto-ransomware was also up
duing June, reaching its highest

levels since December of 2014.
80
72
70
62
THOUSANDS
60
50
43
48
46
40
36
31
28
30
20
20
21
23
16
10

Source: Symantec
J
2015
12 | June 2015
The proportion of email traffic
J
2015
100
containing malware decreased

again this month, down from one
in 207 emails in May to one in
319 emails in June.
150
195
1 IN
200
207
207
237
246
250
270
246
274
300
350
319
329
351
351
400
Inverse Graph: Smaller Number = Greater Risk

Source: Symantec
The percentage of email malware
that contains a URL remained low

in June, hovering around three
percent.
50
41
40
30
20
10
14
7
3
J
J
2015
3
F

Source: Symantec
13 | June 2015
The Transportation,
Industry
June
May
1 in 230.2
1 in 305.5
1 in 231.6
1 in 175.3
1 in 245.9
1 in 150.4
1 in 296.7
1 in 164.5
Wholesale
1 in 301.6
1 in 157.7
Construction
1 in 305.8
1 in 240.9
1 in 365.3
1 in 236.6
Mining
1 in 371.5
1 in 325.8
1 in 481.5
1 in 292.8
1 in 497.7
1 in 255.9
Communications, Electric, Gas,

& Sanitary Services sector was
the most targeted industry in
June, with one in 230 emails
containing malware.
Proportion of Email Traffic Identified as Malicious

by Industry Sector
Proportion of Email Traffic Identified as Malicious by Industry Sector

Organizations with 1501-2500
Company Size
June
May
1-250
1 in 255.6
1 in 141.3
251-500
1 in 232.9
1 in 159.5
501-1000
1 in 318.1
1 in 221.3
1001-1500
1 in 292.2
1 in 205.0
1501-2500
1 in 164.0
1 in 264.6
2501+
1 in 472.4
1 in 303.6
Proportion of Email Traffic Identified as Malicious

by Organization Size
Proportion of Email Traffic Identified as Malicious by Organization Size
employees were most likely to be

targeted by malicious email in
the month of June, where one in
164 emails contained malware.
14 | June 2015
Mobile & Social Media

In June there was one new
mobile malware familiy

discovered.
8
7
5
4
4
3
3
2
0
J
J
2015

Source: Symantec
There was an average of 40
Android malware variants per

family in the month of in June.
50
40
37
34
34
33
36
36
38
38
38
39
39
40
J
2015
30
20
10

Source: Symantec
15 | June 2015
In the last twelve months, 83
Last 12 Months
100
Fake offerings comprised 11
83
80
percent of social media threats.
60
40
20
11
5
Manual
Sharing
Fake
Offering
Likejacking
1.4
0.1
Fake
Apps
Comment
Jacking
Manual Sharing These rely on victims to actually do the work of sharing

the scam by presenting them with intriguing videos, fake offers or messages that they share
with their friends.
Fake Offering These scams invite social network users to join a fake event or group
with incentives such as free gift cards. Joining often requires the user to share
credentials with the attacker or send a text to a premium rate number.
Likejacking Using fake Like buttons, attackers trick users into clicking website
buttons that install malware and may post updates on a users newsfeed, spreading the attack.
Fake Apps Users are invited to subscribe to an application that appears to be
integrated for use with a social network, but is not as described and may be used to steal
credentials or harvest other personal data.
Comment Jacking This attack is similar to the "Like" jacking where the attacker tricks the
user into submitting a comment about a link or site, which will then be posted to his/her wall.
Social Media
Source: Symantec
Social Media
percent of social media threats

required end users to propagate
them.
16 | June 2015
Spam
50
51
49.7%
51.5%
-1.8% pts
-0.6% pts
June
May
52
The overall email spam rate
further declined in June,

dropping below 50 percent, to
49.7 percent.
52.1%
April

Source: Symantec
At over 56 percent, the Mining
Industry
May
April
Mining
56.1%
55.4%
Manufacturing
53.7%
53.7%
Construction
53.3%
54.1%
Retail
53.1%
52.1%
53.0%
51.6%
52.6%
52.5%
52.3%
52.3%
52.3%
51.4%
Wholesale
52.2%
52.1%
51.9%
51.7%
Proportion of Email Traffic Identified as Spam by Industry Sector

Proportion
of Email Traffic Identified as Spam by Industry Sector
sector had the highest spam

rate again during June. The
Manufacturing sector came in
second with 54 percent.
17 | June 2015
While all organization sizes had
Company Size
May
April
1250
52.8%
52.7%
251500
53.2%
52.6%
5011000
52.4%
52.0%
10011500
51.9%
52.2%
15012500
52.1%
52.2%
2501+
52.3%
52.2%

around a 52-53 percent spam

rate, organizations with 251-500
employees had the highest rate
at 53.2 percent.
18 | June 2015
About Symantec
Symantec Corporation (NASDAQ: SYMC) is an information protection expert that helps people,
businesses and governments seeking the freedom to unlock the opportunities technology brings
anytime, anywhere. Founded in April 1982, Symantec, a Fortune 500 company, operating one of
the largest global data-intelligence networks, has provided leading security, backup and availability
solutions for where vital information is stored, accessed and shared. The companys more than 20,000
employees reside in more than 50 countries. Ninety-nine percent of Fortune 500 companies are
Symantec customers. In fiscal 2014, it recorded revenues of $6.7 billion. To learn more go to
www.symantec.com or connect with Symantec at: go.symantec.com/socialmedia.
More Information

Symantec Worldwide: http://www.symantec.com/

ISTR and Symantec Intelligence Resources: http://www.symantec.com/threatreport/

Symantec Security Response: http://www.symantec.com/security_response/

Norton Threat Explorer: http://us.norton.com/security_response/threatexplorer/

Norton Cybercrime Index: http://us.norton.com/cybercrimeindex/
Symantec Corporation World Headquarters

350 Ellis Street
Mountain View, CA 94043 USA
+1 (650) 527 8000
1 (800) 721 3934
www.symantec.com
For specific country offices

and contact numbers,
please visit our website.
For product information in the U.S.,
call toll-free 1 (800) 745 6054.
Copyright 2015 Symantec Corporation.

All rights reserved. Symantec, the Symantec Logo,
and the Checkmark Logo are trademarks or registered
trademarks of Symantec Corporation or its affiliates in
the U.S. and other countries. Other names may
be trademarks of their respective owners
04/1521,500-21347932

Intelligence Report June 2015

Uploaded by

Document Information

Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Description:

Copyright:

Available Formats

Intelligence Report June 2015

Uploaded by

Description:

Copyright:

Available Formats

SYMANTEC INTELLIGENCE REPORT

Top 10 Industries Targeted in Spear-Phishing Attacks

Total Number of Vulnerabilities

New Malware Variants

Android Mobile Malware Families by Month

Overall Email Spam Rate

Welcome to the June edition of the Symantec

Targeted Attacks & Phishing

Finance, Insurance, & Real Estate

Services - Non Traditional

was targeted with the greatest

Top 10 Industries Targeted in Spear-Phishing Attacks

Top 10 Industries Targeted in Spear-Phishing Attacks

Spear-Phishing Attacks by Size of Targeted Organization

Spear-Phishing Attacks by Size of Targeted Organization

of 25.1 percent of spear-phishing

The overall phishing rate has

decreased slightly this month,

Inverse Graph: Smaller Number = Greater Risk

Agriculture, Forestry, & Fishing

Finance, Insurance & Real Estate

Services - Non Traditional

Proportion of Email Traffic Identified as Phishing

Fishing sector was once again the

Small companies with less than

Proportion of Email Traffic Identified as Phishing

250 employees were again the

declined in June, down from 579

Total Number of Vulnerabilities

Total Number of Vulnerabilities

vulnerability discovered in May,

While two vulnerabilities in

Vulnerabilities Disclosed in Industrial Control Systems

Vulnerabilities Disclosed in Industrial Control Systems

industrial control systems were

million new pieces of malware

New Malware Variants

Top 10 Mac OS X Malware Blocked on OS X Endpoints

Top 10 Mac OSX Malware Blocked on OSX Endpoints

the most commonly seen OS X

Ransomware attacks were up in

June for the second month in a

Ransomware Over Time

Ransomware Over Time

Crypto-ransomware was also up

duing June, reaching its highest

Crypto-Ransomware Over Time

Crypto-Ransomware Over Time

The proportion of email traffic

containing malware decreased

Inverse Graph: Smaller Number = Greater Risk

Proportion of Email Traffic in Which Malware Was Detected

Proportion of Email Traffic in Which Malware Was Detected

The percentage of email malware

that contains a URL remained low

Percent of Email Malware as URL vs. Attachment by Month

Percent of Email Malware as URL vs. Attachment by Month

Agriculture, Forestry, & Fishing

Services - Non Traditional

Finance, Insurance, & Real Estate

Communications, Electric, Gas,

The overall phishing rate has

Small companies with less than

While two vulnerabilities in

Ransomware attacks were up in

Crypto-ransomware was also up

The proportion of email traffic

The percentage of email malware

In the last twelve months, 83

Fake offerings comprised 11

The overall email spam rate

At over 56 percent, the Mining

While all organization sizes had