McAfee Report Sees Malware Repurposed to Strike Various Economic Sectors

  McAfee Report Sees Malware Repurposed to Strike Various Economic Sectors

Cybercriminals Up Their Game with Beneath-the-OS Threats and Digitally-Signed
   Malware; Malicious URLs Eclipsing Botnets as Malware Distribution Leader

Business Wire

SANTA CLARA, Calif. -- February 21, 2013

McAfee today released theMcAfee Threats Report: Fourth Quarter 2012, (report)
in which McAfee Labs revealed that sophisticated attacks originally targeting
the financial services industry are now increasingly directed at other
critical sectors of the economy, while an emerging set of new tactics and
technologies are being implemented to evade industry-standard security
measures. The report showed the continued proliferation of password-stealing
trojans and advanced persistent threats (APTs) such as Operation High Roller
and Project Bliztkrieg, and the expansion of their attacks to government,
manufacturing and commercial transaction infrastructure targets.

“We are seeing attacks shifting into a variety of new areas, from factories,
to corporations, to government agencies, to the infrastructure that connects
them together,” said Vincent Weafer, senior vice president of McAfee Labs.
“This represents a new chapter in cybersecurity in that threat-development,
driven by the lure of financial industry profits, has created a growing
underground market for these cybercrime weapons, as well as creative new
approaches to thwarting security measures common across industries.”

Leveraging data from McAfee’s Global Threat Intelligence (GTI) network, the
McAfee Labs team of 500 multidisciplinary researchers in 30 countries follows
the complete range of threats in real time, identifying application
vulnerabilities, analyzing and correlating risks, and enabling instant
remediation to protect enterprises and the public. In Q4 2012, McAfee Labs
identified the following trends:

More Threats, More Availability, More Industries Targeted

As a group, unique password-stealing trojans grew 72 percent in Q4 as
cybercriminals realized that user authentication credentials constitute some
of the most valuable intellectual property stored on most computers. Now
widely available, these trojans are increasingly appearing within customized
threats or combined with other “off-the-shelf” threats available on the
internet. Fourth quarter revelations around the Citadel trojan suggest that
this trojan’s information theft capabilities are being deployed beyond the
financial services sector.

Web Threats Shift from Botnets to URLs

McAfee continued to see suspicious URLs replacing botnets as the primary
distribution mechanism for malware. An analysis of web threats found that the
number of new suspicious URLs increased by 70 percent in Q4. New suspect URLs
averaged 4.6 million per month, almost doubling the previous 2.7 million per
month figure from the last two quarters. Ninety-five percent of these URLs
were found to be hosting malware, exploits or code designed specifically to
compromise computers. The decline in the number of infected systems controlled
by botnet operators is driven in part by law enforcement efforts to bring
botnets down, but perhaps more so by the declining appeal of the botnet
business model.

Increase in Infections beneath the OS

The volume of Master Boot Record-related malware climbed 27 percent to reach
an all-time quarterly high. These threats embed themselves deep within the PC
system storage stack, where standard antivirus solutions cannot detect them.
Once embedded, they can steal user information, download other malicious
software, or leverage the infected PC’s computing power to launch attacks
against other PCs or networks. While these MBR attacks represent a relatively
small portion of the overall PC malware landscape, McAfee Labs expects them to
become a primary attack vector in 2013.

Malicious Signed Binaries Circumvent System Security

The number of electronically-signed malware samples doubled over the course of
Q4. This clearly indicates that cybercriminals have decided that signing
malware binaries is one of the best ways to circumvent standard system
security measures.

Mobile Malware Continues to Increase and Evolve

The number of mobile malware samples discovered by McAfee Labs in 2012 was 44
times the number found in 2011, meaning 95 percent of all mobile malware
samples appeared in the last year alone. Cybercriminals are now dedicating the
majority of their efforts to attacking the mobile Android platform, with an 85
percent jump of new Android-based malware samples in Q4 alone. The motivation
for deploying mobile threats is rooted in the inherent value of the
information found on mobile devices, including passwords and address books, as
well as new “business” opportunities that are not available on the PC
platform. These opportunities include Trojans that send SMS messages to
premium services, then charge the user for each message sent. More information
on mobile-specific malware can also be found in the recently-released 2012
Consumer Mobile Trends Report:

To learn more about malicious activity and the most recent threat findings in
the full copy of the McAfee Threats Report, Fourth Quarter 2012, please visit:

About McAfee

McAfee, a wholly owned subsidiary of Intel Corporation (NASDAQ:INTC), empowers
businesses, the public sector, and home users to safely experience the
benefits of the Internet. The company delivers proactive and proven security
solutions and services for systems, networks, and mobile devices around the
world. With its Security Connected strategy, innovative approach to
hardware-enhanced security, and unique Global Threat Intelligence network,
McAfee is relentlessly focused on keeping its customers safe

Note: McAfee is a trademark or registered trademark of McAfee, Inc. in the
United States and other countries. Other names and brands may be claimed as
the property of others.


Chris Palm, 408-346-3089
Zeno Group
Stephanie Chaney, 312-222-1758
Press spacebar to pause and continue. Press esc to stop.