Recent attacks uncovered by GFI Labs reveal pattern of recycled cybercrime tactics adapted to conceal fraudulent purposes
GFI® Software today released its VIPRE® Report for December 2011, a collection of the 10 most prevalent threat detections encountered during the month. Phishing campaigns once again proved to be among the most significant threats, with scammers targeting Chase and Barclays customers, as well as launching malware attacks against Amazon shoppers expecting holiday packages.
“The threats we uncovered last month illustrate the consistent reuse of tried-and-true attack methods slightly modified to target new groups of potential victims,” said Christopher Boyd, senior threat researcher at GFI Software. “Most cyber-attacks at any given time rely on old techniques deployed with a new disguise. The reason we see them again and again is quite simply because they work, and we anticipate 2012 to bring many fresh takes on old scams.”
In a continuing trend highlighted in the last VIPRE Report, bank related phishing is increasingly becoming a common threat. Barclays customers received messages from a free Yahoo email address claiming that their account had been suspended due to incorrect login attempts. The phishers employed scare tactics by insisting information had to be provided to reactivate the account within a certain amount of time. Once the victim’s identity was submitted, they were redirected to the official Barclays website in order to further mask the crime. Chase clients were targeted by a similar phishing campaign last month as well.
Online shoppers also continue to be a popular pool of potential victims. Emails disguised as messages from Amazon fooled users into clicking a link to infected websites hosting Black Hole Exploit Kits. These kits are designed to take advantage of unpatched Windows® operating systems and software. An infected PDF file was then downloaded to the victim’s computer which exploits a vulnerability in Adobe® Reader® and loads malware onto the system.
Another familiar cybercrime tactic that continued to gain momentum in December was scareware—fake antivirus software and system utility programs—that warn infected users of completely false threats to their computers. GFI Labs document several new variants of these rogue programs on its Malware Protection Center blog.
“Most malware is avoidable,” continued Boyd. “Knowing how cybercriminals operate and understanding how to recognize common attacks are the first steps toward keeping your PC clean and your personal information safe. Most cybercrime requires the victim to aid in the process. A little caution and common sense can go a long way in helping users avoid becoming unwitting accomplices.”
Top 10 Threat Detections for December
GFI’s top 10 threat detection list is compiled from collected scan data of tens of thousands of GFI VIPRE Antivirus customers who are part of GFI’s ThreatNet™ automated threat tracking system. ThreatNet statistics revealed that Trojans still dominated the month, making up half of the top threats detected.
| Detection | Type | Percent |
| Trojan.Win32.Generic | Trojan | 34.41 |
| FraudTool.Win32.FakeRean | Rogue Security Program | 2.82 |
| Yontoo (v) | Adware | 2.36 |
| Trojan.FakeAlert | Trojan | 1.52 |
| INF.Autorun (v) | Trojan | 1.24 |
| Exploit.PDF-JS.Gen (v) | Exploit | 0.93 |
| Trojan.Win32.Ramnit.c (v) | Trojan | 0.89 |
| Trojan.JS.Obfuscator.w (v) | Trojan | 0.87 |
| Yontoo | Adware | 0.84 |
| GameVance (fs) | Adware | 0.82 |
About GFI Labs
GFI Labs specializes in the discovery and analysis of dangerous vulnerabilities and malware that could be exploited for Internet and email attacks. The research team actively researches new malware outbreaks, creating and testing new threat definitions on a constant basis for the VIPRE home and business antivirus products.
About GFI
GFI Software provides web and mail security, archiving and fax, networking and security software and hosted IT solutions for small to medium-sized businesses (SMB) via an extensive global partner community. GFI products are available either as on-premise solutions, in the cloud or as a hybrid of both delivery models. With award-winning technology, a competitive pricing strategy, and a strong focus on the unique requirements of SMBs, GFI satisfies the IT needs of organizations on a global scale. The company has offices in the United States, UK, Austria, Australia, Malta, Hong Kong, Philippines and Romania, which together support hundreds of thousands of installations worldwide. GFI is a channel-focused company with thousands of partners throughout the world and is also a Microsoft Gold ISV Partner.