Sophos security report reveals Trojan domination in H1, 2006

Sophos, a world leader in IT security, has published new research into cyber crime over the past six months. The Sophos Security Threat Management Report Update reveals that while there has been a vast drop in the number of new viruses and worms being written, the prevalence of other types of malware has increased, as cyber criminals turn their attention to stealing information and money.

Most interestingly, new Trojans now outweigh viruses and worms by 4:1, compared to 2:1 in the first half of 2005. In addition, the continued dominance of Windows-based threats has prompted Sophos to suggest that many home users should consider switching to Apple Macs, to shield themselves from the malware onslaught.

Findings show that the most widespread threat from January to date is the Sober-Z worm, which, at its peak, accounted for one in every 13 e-mails. The worm`s dominance is evidence of trends moving away from e-mail virus attacks, since Sober-Z maintains a monopoly despite having stopped spreading on 6 January 2006. Further reinforcing this, only one in every 91 of all e-mails was viral so far this year, compared with one in every 35 for the same period in 2005.

The top 10 list of malware in the first six months of 2006:

1. Sober-Z (22.4%)
2. Netsky-P (12.2%)
3. Zafi-B (8.9%)
4. Nyxem-D (5.9%)
5. Mytob-FO (3.3%)
6. Netsky-D (2.4%)
7. Mytob-BE (2.3%)
8. Mytob-EX (2.2%)
8. Mytob-AS (2.2%)
10. Bagle-Zip (1.9%)
Others 36.3%

All of the above malware works on Windows; none is capable of infecting Mac OS X.

The rise in the overall level of malware indicates that spyware, Trojan horses and phishing are now the more favoured methods of attack.

In June 2005, the number of different pieces of malware protected against by Sophos stood at 140 118. A year later, by June 2006, Sophos was identifying and protecting against 180 292 different viruses, spyware, worms, Trojan horses and other malware, as well as adware and other potentially unwanted applications (PUAs). The vast majority of malware continues to be written for Windows, and while the first malware for Mac OS X was seen in February 2006, it has not spread in the wild and not heralded an avalanche of malicious code aimed at Macs.

"Criminals responsible for the rise of malware are obviously making money from their code, otherwise they`d give up the game," says Brett Myroff, CEO of local Sophos distributor, NetXactics. "It`s vital that organisations use an integrated security solution to protect against intrusion, as well as blocking known and unknown malware.

"Hackers are primarily targeting Windows users and it seems likely that Macs will continue to be safer for some time to come. Home users might want to consider this option for their next computer purchase."

Of the new threats protected against during the first six months of 2006, 82% have been Trojan horses, which cannot spread alone and are typically targeted at particular groups of people - heightening the chances of tricking users into handing over money or information. However, Sophos`s top 10 chart of the most prevalent malware, according to families of threats, shows that the Clagger family of Trojan horses has been spammed out so aggressively that they collectively account for the eighth most prevalent threat.

The top 10 list of malware families in the first six months of 2006:

1. Mytob (28.7%)
2. Sober (22.6%)
3. Netsky (19%)
4. Zafi (9.9%)
5. Nyxem (5.9%)
6. Bagle (4.3%)
7. MyDoom (3.3%)
8. Clagger (1.3%)
9. Dolebot (1.1%)
10. Lovgate (0.8%)
Others 3.1%

Again, all of the above malware works on Microsoft Windows; none is capable of infecting the Mac OS.

Clagger Trojans have been distributed under the guise of e-mails from organisations that include Amazon and PayPal. February 2006 saw the first ever Trojan horse, Clagger-G, enter the monthly top 10 malware chart, and the following month, Clagger-I burst in at sixth position.

These Trojans had to be mass-spammed to millions of e-mail addresses in order to enter the chart. Their prevalence shows that cyber criminals are continually repackaging their malicious code and using spam technology to generate illegitimate income, says Myroff.

"Most perpetrators now opt for smaller, strategically targeted attacks, which are more manageable and have better chances of tricking computer users."

2006 has also seen the introduction of a new kind of Trojan horse attack, whereby infected users can find their data and files "kidnapped" and held to ransom. Deemed `ransomware`, users are typically blackmailed into paying to have their data retrieved or risk losing it altogether. Three recent examples include the Ransom-A, Zippo-A and Arhiveus-A Trojans - all of which caused havoc and panic for poorly protected computer users.

Given these tactics, it`s understandable that authorities are giving out increasingly harsh sentences. In May 2006, the longest ever sentence was dealt out for spreading malware, when 21-year-old American, Jeanson James Ancheta, received a 57-month prison sentence for running a zombie network. The pending extradition of British hacker, Gary McKinnon to the US is further evidence of authorities clamping down on cyber crime. McKinnon, who hacked into Pentagon and NASA computers, could face decades in jail and hefty fines.

The report is available at: http://www.sophos.com/virusinfo/whitepapers/sophos-security-report-jun06-srus