SlideShare une entreprise Scribd logo
1  sur  11
Télécharger pour lire hors ligne
Phishing Activity Trends Report

2 Quarter
2013
nd

!

!

Unifying the
Global Response
To Cybercrime

April – June 2013
Published November 5 , 2013
Phishing Activity Trends Report, 2nd Quarter 2013
!
Fraudsters Seek New Victims and
Brands in Untapped Markets!

!

Phishing Report Scope
The!APWG%Phishing%Activity%Trends%Report!analyzes!
phishing!attacks!reported!to!the!APWG!by!its!member!
companies,!its!Global!Research!Partners,!through!the!
organization’s!website!at!http://www.apwg.org,!and!by!
eBmail!submissions!to!reportphishing@antiphishing.org.!
APWG!also!measures!the!evolution,!proliferation,!and!
propagation!of!crimeware!by!drawing!from!the!research!
of!our!member!companies.!!

Phishing Defined!!
Phishing!is!a!criminal!mechanism!employing!both!social%
engineering!and!technical%subterfuge!to!steal!consumers’!
personal!identity!data!and!financial!account!credentials.!
Social!engineering!schemes!use!spoofed!eBmails!
purporting!to!be!from!legitimate!businesses!and!
agencies,!designed!to!lead!consumers!to!counterfeit!
websites!that!trick!recipients!into!divulging!financial!
data!such!as!usernames!and!passwords.!Technical!
subterfuge!schemes!plant!crimeware!onto!PCs!to!steal!
credentials!directly,!often!using!systems!to!intercept!
consumers!online!account!user!names!and!passwords!BB!
and!to!corrupt!local!navigational!infrastructures!to!
misdirect!consumers!to!counterfeit!websites!(or!authentic!
websites!through!phisherBcontrolled!proxies!used!to!
monitor!and!intercept!consumers’!keystrokes).!!

Some%441%brands%were%hijacked%in%April,%a%record%high%that%
surpassed%the%previous%monthly%high%of%430%in%November%2012%[p.%6]%
!

2nd Quarter 2013 Phishing Activity Trends Summary
●!During!the!second!quarter!of!2013,!a!total!of!639!unique!
brands!were!targeted!by!phishing!attacks.!This!number!
topped!the!previous!high!of!614!seen!in!Q4!2012.![p.!6]!!
●!!Phishing!hosted!in!Russia!almost!disappeared!in!June,!
replaced!by!phishing!hosted!in!Kazakhstan.!This!was!a!
temporary!shift!highlighting!the!mobility!of!criminal!!
infrastructure.![p.!7]!!
●!The!number!of!unique!phishing!reports!submitted!to!

Table of Contents
!

APWG!saw!a!steady!decrease!during!the!quarter,!

Statistical Highlights for 2nd Quarter 2013

3

Phishing E-mail Reports and Phishing Site Trends
!

dropping!nearly!27!percent!from!April!to!June.![p.!4]!

4

Brand-Domain Pairs Measurement

5

Brands & Legitimate Entities Hijacked by
!
E-mail Phishing Attacks

6

!
Most Targeted Industry Sectors

7

Countries Hosting Phishing Sites

7

Top Malware Infected Countries

8

Measurement of Detected Crimeware

9

Phishing-based Trojans & Downloader’s Host

●!The!number!of!new!malware!samples!continues!to!rise.!
In!Q2!2013,!some!12!percent!more!malware!samples!were!
captured!than!in!the!same!period!last!year.![p.!8]!
●!The!online!game!sector!experienced!a!notable!drop!in!
phishing,!from!5.66!percent!in!Q1!2013!down!to!2.03!
percent!in!Q2!2013.![p.!7]!

Countries (by IP address)

10

2! Phishing by Top-Level Domain

10

●!In!May,!Germany!surpassed!the!United!States!as!the!top!

11

country!hosting!phishingBbased!Trojans!and!downloaders.!

APWG Phishing Trends Report Contributors

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Phishing Activity Trends Report
2 nd Quarter 2013
www.apwg.org • info@apwg.org!
!

[p.!10]!
!

!

!

!
Phishing Activity Trends Report, 2nd Quarter 2013
!
!
!

Methodology and Instrumented Data Sets

An!eBmail!campaign!is!a!unique!eBmail!sent!out!to!multiple!users,!directing!them!to!a!specific!phishing!web!site!
(multiple!campaigns!may!point!to!the!same!web!site).!APWG!counts!unique!phishing!report!eBmails!as!those!in!a!
given!month!with!the!same!subject!line!in!the!eBmail.!!
!
The!APWG!also!tracks!the!number!of!unique!phishing!websites.!This!is!now!determined!by!the!unique!base!URLs!of!
the!phishing!sites.!(A!single!phishing!site!may!be!advertised!as!thousands!of!customized!URLS,!all!leading!to!
basically!the!same!attack!destination.)!APWG!additionally!tracks!crimeware!instances!(unique!software!applications!
as!determined!by!MD5!hash!of!the!crimeware!sample),!as!well!as!unique!sites!that!are!distributing!crimeware!
(typically!via!browser!driveBby!exploits).!The!APWG%Phishing%Activity%Trends%Report!also!includes!statistics!on!rogue!
antiBvirus!software,!desktop!infection!rates,!and!related!topics.!
!
Special!Note!for!Readers!of!Q2!2013!Trends%Report:!The!APWG!continues!to!refine!its!tracking!and!reporting!
methodology!and!to!incorporate!new!data!sources!into!our!reports.!APWG!has!reBinstated!the!tracking!and!
reporting!of!unique!phishing!reports!(eBmail!campaigns)!in!addition!to!unique!phishing!sites!with!this!quarterly!
report.!!We!plan!on!reviewing!our!metrics!and!reporting!systems!over!the!next!six!months,!in!order!to!keep!pace!
with!change!in!the!environment!and!continue!to!provide!fresh!insights!to!the!public.!
!
!
! Statistical Highlights for 2nd Quarter 2013

!
Number!of!unique!phishing!websites!detected!

April!

May!

June!

36,480!

44,511!

38,110!

20,086!

18,297!

14,698!

441!

431!

425!

USA!

USA!

USA!

50.92%!

57.45%!

51.52%!

No!hostname;!just!IP!address!

4.57%!

5.23%!

5.26%!

Percentage!of!sites!not!using!port!80!

0.38%!

0.45%!

0.80%!

Number!of!unique!phishing!eBmail!reports!(campaigns)!received!
by!APWG!from!consumers!
Number!of!brands!targeted!by!phishing!campaigns!
Country!hosting!the!most!phishing!websites!
Contain!some!form!of!target!name!in!URL!

!

3!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Phishing Activity Trends Report
2 nd Quarter 2013
www.apwg.org • info@apwg.org!
!

!

!
Phishing Activity Trends Report, 2nd Quarter 2013
!
Phishing E-mail Reports and Phishing Site Trends – 2nd Quarter 2013
!
The!number!of!phishing!sites!detected!fluctuated!by!nearly!10,000!sites!month!to!month!during!both!Q1!and!Q2,!
with!APWG!seeing!a!18!percent!increase!from!April!to!May,!2013.!Apriles!36,480!was!the!secondBlowest!number!on!
record,!a!little!higher!than!the!historical!low!of!35,024!recorded!in!February!2013.!

!
!
!
!
!
!
!
!
!
!
!
!
!
!
The!number!of!unique!phishing!reports!submitted!to!APWG!each!month!saw!a!steady!decrease!during!the!quarter,!
!
dropping!nearly!27!percent!from!April!to!June.!Junees!total!of!14,698!was!63!percent!lower!than!the!allBtime!high!of!
!

4!

40,621!reports,!recorded!in!August!2009.!It!is!not!unusual!for!phishing!activity!to!decline!a!bit!in!the!summer!months.!
!
! !!!
!
!!
!
!!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Phishing Activity Trends Report
2 nd Quarter 2013
www.apwg.org • info@apwg.org!
!

!

!
Phishing Activity Trends Report, 2nd Quarter 2013
!
Brand-Domain Pairs Measurement – 2nd Quarter 2013

!
The!following!chart!combines!statistics!based!on!brands!phished,!unique!domains,!unique!domain/brand!pairs,!and!
unique!URLs.!Brand/domain!pairs!count!the!unique!instances!of!a!domain!being!used!to!target!a!specific!brand.!
(Example:!!if!several!URLs!are!targeting!a!brand!–!but!are!hosted!on!the!same!domain!–!this!brand/domain!pair!
would!be!counted!as!one!instead!of!several.)!Forensic%utility%of!this!metric:!If!the!number!of!unique!URLs!is!greater!
than!the!number!of!brand/domain!pairs,!it!indicates!many!URLs!are!being!hosted!on!the!same!domain!to!target!the!
same!brand.!Knowing!how!many!URLs!occur!with!each!domain!indicates!the!approximate!number!of!attacking!
domains!a!brandBholding!victim!needs!to!locate!and!neutralize.!Since!phishingBprevention!technologies!(like!
browser!and!eBmail!blocking)!require!the!full!URL,!it!is!useful!to!understand!the!general!number!of!unique!URLs!
that!occur!per!domain.!!
!
The!number!of!unique!brandBdomain!pairs!fluctuated!during!second!quarter!of!2013.!The!high!for!the!threeBmonth!
period!was!in!May,!with!14,033!brandBdomain!pairs,!dropping!back!to!11,960!in!June.!
!
%%
!
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
%
!
April!
May!
June!
Number!of!Unique!Phishing!Web!Sites!Detected!
!
Unique!Domains!

44,511!

38,110!

10,849!

12,180!

10,329!

!
Unique!BrandBDomain!Pairs!

!

36,480!
12,460!

14,033!

11,960!

441!

431!

425!

88.75!

103.27!

89.64!

Unique!Brands!
!
URLs!Per!Brand!
!

5!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Phishing Activity Trends Report
2 nd Quarter 2013
www.apwg.org • info@apwg.org!
!

!

!
Phishing Activity Trends Report, 2nd Quarter 2013
!
!Brands Targeted by E-mail Phishing Attacks – 2nd Quarter 2013
!
The!number!of!brands!targets!by!phishers!reached!an!allBtime!high!of!441!in!April,!surpassing!the!old!monthly!record!
of!430!seen!in!November!2012.!!iThe!landscape!continues!to!evolve!as!fraudsters!seek!new!victims!in!untapped!markets!
by!targeting!more!brands,”!said!Ihab!Shraim,!Trends%Report!contributing!analyst!and!CISO!and!Vice!President!AntiB
Fraud!Engineering!and!Operations!at!MarkMonitor.!“During!the!second!quarter!of!2013,!a!total!639!unique!brands!
were!targeted!by!phishing!attacks.!This!number!topped!the!previous!high!of!614!seen!in!Q4!2012.i!!!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!

6!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Phishing Activity Trends Report
2 nd Quarter 2013
www.apwg.org • info@apwg.org!
!

!

!
Phishing Activity Trends Report, 2nd Quarter 2013
!
Most-Targeted Industry Sectors – 2nd Quarter 2013

!
Payment!Services!continued!to!be!the!mostBtargeted!industry!sector.!Most!sectors!remained!consistent!with!the!first!
quarter!of!2013,!except!for!computer!and!online!gaming,!which!experienced!a!notable!drop!from!5.66!percent!in!Q1!
2013!to!2.03!percent!in!Q2!2013.!!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!Countries Hosting Phishing Sites – 2nd Quarter 2013!
!

!
Russia!has!traditionally!been!near!the!top!of!the!list!of!countries!where!phishing!sites!have!been!hosted.!But!in!June!
2013,!phishing!on!Russian!hosting!almost!disappeared,!with!Kazakhstan!suddenly!appearing!in!the!#2!spot:!
!!
April!

!!!May!!!!!!!!!!!!!!!!!!!!!!

June!

United!States!

36.21%! United!States!

44.03%! United!States!

Hong!Kong!

19.38%! Russian!Federation! 11.58%! Kazakhstan!

45.47%!
7.11%!

Russian!Federation!

7.67%! United!Kingdom!

4.79%! France!

6.78%!

Germany!

4.37%! Germany!

4.43%! Germany!

5.73%!

Canada!

3.96%! Finland!

3.92%! Canada!

4.31%!

Brazil!

3.54%! Turkey!

3.67%! United!Kingdom!

3.11%!

Angola!

2.68%! Canada!

3.38%! Brazil!

2.45%!

United!Kingdom!

2.42%! Brazil!

2.17%! Turkey!

1.70%!

France!

2.33%! Indonesia!

1.90%! Malaysia!

1.58%!

Thailand!

2.15%! Ireland!

1.56%! Ukraine!

1.40%!

!

7!

“We!know!that!Kazakhstan!is!enjoying!an!uptake!in!the!adoption!of!mobile!payments,!so!it’s!not!a!surprise!that!
phishers!have!sought!to!move!to!this!area,”!said!Trends%Report!contributing!analyst!Carl!Leonard!of!Websense!Security!
Labs.!“A!spate!of!phishing!hosted!in!Hong!Kong!also!disappeared!in!late!April.!The!portability!of!a!phishing!
infrastructure!is!wellBdocumented,!and!criminals!continue!to!attempt!to!evade!detection!and!shutBdowns!by!moving!
their!infrastructure!around.”!
!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Phishing Activity Trends Report
2 nd Quarter 2013
www.apwg.org • info@apwg.org!
!

!

!
Phishing Activity Trends Report, 2nd Quarter 2013
!
Crimeware Taxonomy and Samples According to Classification

!
The!APWG’s!Crimeware!statistics!categorize!crimeware!attacks!as!follows,!though!the!taxonomy!will!grow!as!
variations!in!attack!code!are!spawned.!Definition:!!Crimeware!is!code!designed!with!the!intent!of!collecting!
information!on!the!endBuser!in!order!to!steal!the!user’s!credentials.!Unlike!most!generic!keyloggers,!phishingBbased!
keyloggers!have!tracking!components,!which!attempt!to!monitor!specific!actions!(and!specific!organizations,!such!as!
financial!institutions,!retailers,!and!eBcommerce!merchants)!in!order!to!target!specific!information.!The!most!
common!types!of!information!are!access!to!financialBbased!websites,!eBcommerce!sites,!and!webBbased!mail!sites.!
!
!
Malware Infected Countries – 2nd Quarter 2013!
!
The!amount!of!new!malware!samples!continued!to!rise.!In!the!second!quarter!of!2013,!12!percent!more!unique!
malware!samples!were!identified!than!in!the!same!period!last!year,!and!an!increase!of!17!percent!in!2013!so!far.!
Trojans!were!the!most!popular,!accounting!for!77.2!percent!of!all!new!malware!created.!According!to!Luis!Corrons,!
PandaLabs!Technical!Director!and!Trends%Report!contributing!analyst,!Trojans!have!reached!recordBsetting!popularity!
as!a!form!of!malware.!
!
!
Type%of%Malware%Identified% %!!of!malware!samples!
Malware%Infections%by%Type% %!!of!malware!samples!
!
Trojans!
77.20%!
Trojans!
79.70%!
!
Viruses!
11.28%!
Viruses!
6.06%!
!
Worms!
10.29%!
Worms!
6.71%!
!
Rogueware!
1.09%!
Rogueware!
3.62%!
!
Other!
.15%!
Other!
3.91%!
!
!
!
!
CyberBcriminals!use!Trojans!as!a!key!tool!to!infect!users’!computing!devices,!and!continually!introduce!changes!to!
evade!the!signatureBbased!detection!used!by!antivirus!firms.!The!process!is!often!automated,!changing!the!binaries!run!
on!victims’!computers!and!leading!to!more!unique!signatures!and!samples.!
!
PandaLabs!estimates!that!in!the!second!quarter!of!2013,!the!percentage!of!infected!computers!worldwide!was!32.77!
percent,!which!was!up!on!the!first!quarter.!More!than!half!of!the!computers!in!China!are!infected.!China!was!followed!
by!Turkey!(43.59%).!A!number!of!Latin!American!countries!have!infection!rates!over!the!global!average:!Peru!(42.14%),!
Brazil!(35.83%),!Guatemala!(35.51%),!Colombia!(33.86%),!Costa!Rica!(33.33%),!and!Chile!(33.22%).!
!
Europe!and!Japan!continue!to!have!the!lowest!infection!rates.!The!USA!fell!in!the!middle!of!the!rankings,!with!a!31.16!
percent!infection!rate.!!
!
Ranking
Country
Infection ratio
Ranking! Country!
Infection!Rate!
!

8!

1!
2!
3!
4!
5!
6!
7!
8!
9!
10!

China!
Turkey!
Peru!
Bolivia!
Ecuador!
Russia!
Argentina!
Taiwan!
Slovenia!
El!Salvador!

35!
36!
37!
38!
39!
40!
41!
42!
43!
44!

52.36%!
43.59%!
42.14%!
41.67%!
41.13%!
41.08%!
39.36%!
38.65%!
38.00%!
37.29%!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!
Phishing Activity Trends Report
2 nd Quarter 2013
www.apwg.org • info@apwg.org!
!

Portugal!
Netherlands!
Switzerland!
Belgium!
France!
UK!
Japan!
Germany!
Norway!
Sweden!

26.79%!
25.82%!
25.60%!
24.87%!
24.54%!
24.48%!
24.21%!
24.18%!
21.14%!
21.03%!

!

!

!
Phishing Activity Trends Report, 2nd Quarter 2013
!
Measurement of Detected Crimeware – 2nd Quarter 2013
!
!
!
Using!data!contributed!from!APWG!founding!member!Websense!regarding!the!proliferation!of!malevolent!
software,!this!metric!measures!proportions!of!three!genera!of!malevolent!code:!!
!
• Crimeware!(dataBstealing!malicious!code!designed!specifically!to!be!used!to!victimize!financial!institutions’!
customers!and!to!coBopt!those!institutions’!identities);!!!
• Data%Stealing%and%Generic%Trojans!(code!designed!to!send!information!from!the!infected!machine,!control!it,!
and!open!backdoors!on!it);!and!!
• Other!(the!remainder!of!malicious!code!commonly!encountered!in!the!field!such!as!autoBreplicating!worms,!
dialers!for!telephone!chargeBback!scams,!etc.)!!
!
!

!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!

9!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Phishing Activity Trends Report
2 nd Quarter 2013
www.apwg.org • info@apwg.org!
!

!

!
Phishing Activity Trends Report, 2nd Quarter 2013
!
!
Phishing-based Trojans and Downloader’s Hosting Countries (by IP address)
!
In!May,!Germany!surpassed!the!United!States!as!the!top!country!hosting!phishingBbased!Trojans!and!downloaders.!
This!is!the!first!time!that!Germany!has!been!ranked!at!the!top.!The!United!States!returned!to!the!top!spot!in!June.!!
April!

May!

June!

United!States!

26.80%! Germany!

28.59%! United!States!

40.66%!

Switzerland!

24.58%! United!States!

27.18%! Germany!

30.42%!

Germany!

18.33%! China!

8.50%! Netherlands!

4.31%!

Russian!Federation!

8.01%! Russian!Federation!

6.38%! China!

4.25%!

China!

3.87%! Netherlands!

6.10%! Russian!Federation!

3.35%!

Ukraine!

2.78%! Switzerland!

3.99%! Rep.!of!Korea!

2.30%!

Spain!

2.35%! France!

3.98%! Romania!

1.40%!

Netherlands!

1.99%! Ukraine!

2.95%! Switzerland!

1.20%!

1.44%! Romania!

2.03%! France!

1.17%!

1.74%! Brazil!

1.13%!

Romania!
United!States!

26.80%! Spain!

!
!
Phishing by Top-Level Domain
!
Internet!Identity!records!the!topBlevel!domains!(TLDs)!used!to!host!phishing!sites.!FortyBfour!percent!of!domains!
used!for!phishing!were!.COM!names,!up!for!42!percent!in!the!previous!quarter.!The!.COM!TLD!represents!
approximately!44!percent!of!domain!names!registered!worldwide.!The!TLD!of!Brazil!(.BR)!continued!to!have!4!
percent!of!phishing!worldwide,!but!only!1!percent!of!the!world!domain!name!market.!!
!
!

10!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Phishing Activity Trends Report
2 nd Quarter 2013
www.apwg.org • info@apwg.org!
!

!

!
Phishing Activity Trends Report, 2nd Quarter 2013
!
APWG Phishing Activity Trends Report Contributors
!

!

!

!

!

!

Illumintel!Inc.!provides!advising!

Internet!Identity!(IID)!is!a!USB

and!security!services!to!topBlevelB

based!provider!of!technology!and!

domain!registry!operators!and!

services!that!help!organizations!

other!Internet!companies.!

secure!their!Internet!presence.!

!!!

!
!

!

!

!
!

!

!

!

!

keep!our!customerse!information!

!

and!IT!assets!safe!from!security!

!

threats,!providing!the!most!
effective!protection!with!

!

!

!

Panda!Security’s!mission!is!to!

!

MarkMonitor,!the!global!leader!in!
enterprise!brand!protection,!offers!
comprehensive!solutions!and!
services!that!safeguard!brands,!
reputation!and!revenue!from!
online!risks.!

minimum!resource!consumption.!

Websense,!Inc.!is!a!global!leader!
in!secure!Web!gateway,!data!loss!
prevention,!and!eBmail!security!
solutions,!protecting!more!than!
43!million!employees!at!
organizations!worldwide.!

!
!
!
!
!
!
!
!

!
!

The!APWG%Phishing%Activity%Trends%Report!is!published!by!the!APWG.!For!further!information!about!the!APWG,!
please!contact!APWG!Deputy!Secretary!General!Foy!Shiver!at!404.434.7282!or!foy@apwg.org.!For!media!inquiries!
related!to!the!content!of!this!report,!please!contact!APWG!Secretary!General!Peter!Cassidy!at!617.669.1123;!Te!
Smith!of!MarkMonitor!at!831.818.1267!or!Te.Smith@markmonitor.com;!Luis!Corrons!of!Panda!at!
lcorrons@pandasoftware.es;!Websense!at!publicrelations@websense.com,!or!ATmedia@internetidentity.com!!
!

About the APWG

!

PWG!thanks!its!contributing!members,!above,!for!the!data!and!analyses!in!this!report0.!

Founded!in!2003,!the!AntiBPhishing!Working!Group!(APWG)!is!a!notBforBprofit!industry!association!focused!on!
eliminating!the!identity!theft!and!frauds!that!result!from!the!growing!problem!of!phishing,!crimeware,!and!eB
mail!spoofing.!Membership!is!open!to!qualified!financial!institutions,!retailers,!ISPs,!solutions!providers,!the!law!
enforcement!community,!government!agencies,!multiBlateral!treaty!organizations,!and!NGOs.!There!are!more!
than!2,000!enterprises!worldwide!participating!in!the!APWG.!Because!electronic!crime!is!a!sensitive!subject,!
APWG!maintains!a!policy!of!confidentiality!of!member!organizations.!
Websites!of!APWG!publicBservice!enterprises!include!its!public!website,!<http://www.antiphishing.org>;!the!
Website!of!public!awareness!program,!STOP.!THINK.!CONNECT.!Messaging!Convention!
<http://www.stopthinkconnect.org>!and!the!APWG’s!research!website!<http://www.ecrimeresearch.org>.!These!
serve!as!resources!about!the!problem!of!phishing!and!electronic!frauds!perpetrated!against!personal!computers!
and!their!users!–!and!resources!for!countering!these!threats.!The!APWG,!a!501c6!taxBexempted!corporation,!was!
founded!by!Tumbleweed!Communications,!financial!services!institutions!and!eBcommerce!providers.!APWG’s!
first!meeting!was!in!November!2003!in!San!Francisco!and!in!June!2004!was!incorporated!as!an!independent!

11!

corporation!controlled!by!its!board!of!directors,!its!executives!and!its!steering!committee.!
!

Analysis!by!Greg!Aaron,!Illumintel;!Trends%Report!editing!by!Ronnie!Manning,!Mynt!Public!Relations.!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Phishing Activity Trends Report
2 nd Quarter 2013
www.apwg.org • info@apwg.org!
!

!

!

Contenu connexe

Similaire à Apwg trends report_q2_2013

Hi-Tech Crime Trends 2015
Hi-Tech Crime Trends 2015Hi-Tech Crime Trends 2015
Hi-Tech Crime Trends 2015
Group-IB
 
Con vox
Con voxCon vox
Con vox
convox
 
Hispanic mobile banking_trends_study_think_now_research
Hispanic mobile banking_trends_study_think_now_researchHispanic mobile banking_trends_study_think_now_research
Hispanic mobile banking_trends_study_think_now_research
ThinkNow
 
CloudCamp. Danile Power - It's All About Managing the App
CloudCamp. Danile Power -  It's All About Managing the AppCloudCamp. Danile Power -  It's All About Managing the App
CloudCamp. Danile Power - It's All About Managing the App
Chris Purrington
 

Similaire à Apwg trends report_q2_2013 (20)

Marketing Automotive Companies through Mobile and Social Media
Marketing Automotive Companies through Mobile and Social Media Marketing Automotive Companies through Mobile and Social Media
Marketing Automotive Companies through Mobile and Social Media
 
Apwg trends report_q3_2016
Apwg trends report_q3_2016Apwg trends report_q3_2016
Apwg trends report_q3_2016
 
Apwg trends report_q4_2016
Apwg trends report_q4_2016Apwg trends report_q4_2016
Apwg trends report_q4_2016
 
Media Report 2013
Media Report 2013Media Report 2013
Media Report 2013
 
GraphTalks Italy - Using graphs to fight financial fraud
GraphTalks Italy - Using graphs to fight financial fraudGraphTalks Italy - Using graphs to fight financial fraud
GraphTalks Italy - Using graphs to fight financial fraud
 
GraphTalks Frankfurt - Leveraging Graph-Technology to fight financial fraud
GraphTalks Frankfurt - Leveraging Graph-Technology to fight financial fraudGraphTalks Frankfurt - Leveraging Graph-Technology to fight financial fraud
GraphTalks Frankfurt - Leveraging Graph-Technology to fight financial fraud
 
Hi-Tech Crime Trends 2015
Hi-Tech Crime Trends 2015Hi-Tech Crime Trends 2015
Hi-Tech Crime Trends 2015
 
Apwg trends report_q1-q3_2015
Apwg trends report_q1-q3_2015Apwg trends report_q1-q3_2015
Apwg trends report_q1-q3_2015
 
Con vox
Con voxCon vox
Con vox
 
Hispanic mobile banking_trends_study_think_now_research
Hispanic mobile banking_trends_study_think_now_researchHispanic mobile banking_trends_study_think_now_research
Hispanic mobile banking_trends_study_think_now_research
 
mobileYouth trends download: Droidettes - will teens drive Android?
mobileYouth trends download: Droidettes - will teens drive Android?mobileYouth trends download: Droidettes - will teens drive Android?
mobileYouth trends download: Droidettes - will teens drive Android?
 
[We Are Social] Social, Digital and Mobile in Vietnam
[We Are Social] Social, Digital and Mobile in Vietnam[We Are Social] Social, Digital and Mobile in Vietnam
[We Are Social] Social, Digital and Mobile in Vietnam
 
CloudCamp. Danile Power - It's All About Managing the App
CloudCamp. Danile Power -  It's All About Managing the AppCloudCamp. Danile Power -  It's All About Managing the App
CloudCamp. Danile Power - It's All About Managing the App
 
Blasting News - NOAH16 London
Blasting News - NOAH16 LondonBlasting News - NOAH16 London
Blasting News - NOAH16 London
 
Apwg trends report_q1_2016
Apwg trends report_q1_2016Apwg trends report_q1_2016
Apwg trends report_q1_2016
 
Mobility Planning
Mobility PlanningMobility Planning
Mobility Planning
 
The 2013 Marquet Report on Embezzlement
The 2013 Marquet Report on EmbezzlementThe 2013 Marquet Report on Embezzlement
The 2013 Marquet Report on Embezzlement
 
mobileYouth trends download: The 2 Speed Handset Economy
mobileYouth trends download: The 2 Speed Handset EconomymobileYouth trends download: The 2 Speed Handset Economy
mobileYouth trends download: The 2 Speed Handset Economy
 
Apwg trends report_q4_2015
Apwg trends report_q4_2015Apwg trends report_q4_2015
Apwg trends report_q4_2015
 
Learn About the Rise of Instagram Pro in 2024
Learn About the Rise of Instagram Pro in 2024Learn About the Rise of Instagram Pro in 2024
Learn About the Rise of Instagram Pro in 2024
 

Plus de Комсс Файквэе

Plus de Комсс Файквэе (20)

Hta t07-did-you-read-the-news-http-request-hijacking
Hta t07-did-you-read-the-news-http-request-hijackingHta t07-did-you-read-the-news-http-request-hijacking
Hta t07-did-you-read-the-news-http-request-hijacking
 
Analitika web 2012_positive_technologies
Analitika web 2012_positive_technologiesAnalitika web 2012_positive_technologies
Analitika web 2012_positive_technologies
 
B istr main-report_v18_2012_21291018.en-us
B istr main-report_v18_2012_21291018.en-usB istr main-report_v18_2012_21291018.en-us
B istr main-report_v18_2012_21291018.en-us
 
Threat report h1_2013
Threat report h1_2013Threat report h1_2013
Threat report h1_2013
 
B intelligence report-08-2013.en-us
B intelligence report-08-2013.en-usB intelligence report-08-2013.en-us
B intelligence report-08-2013.en-us
 
Dtl 2013 q2_home.1.2
Dtl 2013 q2_home.1.2Dtl 2013 q2_home.1.2
Dtl 2013 q2_home.1.2
 
Rp quarterly-threat-q1-2012
Rp quarterly-threat-q1-2012Rp quarterly-threat-q1-2012
Rp quarterly-threat-q1-2012
 
Kaspersky lab av_test_whitelist_test_report
Kaspersky lab av_test_whitelist_test_reportKaspersky lab av_test_whitelist_test_report
Kaspersky lab av_test_whitelist_test_report
 
The modern-malware-review-march-2013
The modern-malware-review-march-2013 The modern-malware-review-march-2013
The modern-malware-review-march-2013
 
Dtl 2012 kl-app_ctl1.2
Dtl 2012 kl-app_ctl1.2Dtl 2012 kl-app_ctl1.2
Dtl 2012 kl-app_ctl1.2
 
Panda labs annual-report-2012
Panda labs annual-report-2012Panda labs annual-report-2012
Panda labs annual-report-2012
 
Course reader-title
Course reader-titleCourse reader-title
Course reader-title
 
Rp threat-predictions-2013
Rp threat-predictions-2013Rp threat-predictions-2013
Rp threat-predictions-2013
 
2012 browser phishing
2012 browser phishing2012 browser phishing
2012 browser phishing
 
Technology auto protection_from_exploit
Technology auto protection_from_exploitTechnology auto protection_from_exploit
Technology auto protection_from_exploit
 
Ndss12 woodpecker
Ndss12 woodpeckerNdss12 woodpecker
Ndss12 woodpecker
 
Hacktivityonly 121013141039-phpapp02
Hacktivityonly 121013141039-phpapp02Hacktivityonly 121013141039-phpapp02
Hacktivityonly 121013141039-phpapp02
 
Bilge12 zero day
Bilge12 zero dayBilge12 zero day
Bilge12 zero day
 
P50 fahl
P50 fahlP50 fahl
P50 fahl
 
2
22
2
 

Dernier

Dernier (20)

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdfTech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdf
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Developing An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of BrazilDeveloping An App To Navigate The Roads of Brazil
Developing An App To Navigate The Roads of Brazil
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 

Apwg trends report_q2_2013

  • 1. Phishing Activity Trends Report 2 Quarter 2013 nd ! ! Unifying the Global Response To Cybercrime April – June 2013 Published November 5 , 2013
  • 2. Phishing Activity Trends Report, 2nd Quarter 2013 ! Fraudsters Seek New Victims and Brands in Untapped Markets! ! Phishing Report Scope The!APWG%Phishing%Activity%Trends%Report!analyzes! phishing!attacks!reported!to!the!APWG!by!its!member! companies,!its!Global!Research!Partners,!through!the! organization’s!website!at!http://www.apwg.org,!and!by! eBmail!submissions!to!reportphishing@antiphishing.org.! APWG!also!measures!the!evolution,!proliferation,!and! propagation!of!crimeware!by!drawing!from!the!research! of!our!member!companies.!! Phishing Defined!! Phishing!is!a!criminal!mechanism!employing!both!social% engineering!and!technical%subterfuge!to!steal!consumers’! personal!identity!data!and!financial!account!credentials.! Social!engineering!schemes!use!spoofed!eBmails! purporting!to!be!from!legitimate!businesses!and! agencies,!designed!to!lead!consumers!to!counterfeit! websites!that!trick!recipients!into!divulging!financial! data!such!as!usernames!and!passwords.!Technical! subterfuge!schemes!plant!crimeware!onto!PCs!to!steal! credentials!directly,!often!using!systems!to!intercept! consumers!online!account!user!names!and!passwords!BB! and!to!corrupt!local!navigational!infrastructures!to! misdirect!consumers!to!counterfeit!websites!(or!authentic! websites!through!phisherBcontrolled!proxies!used!to! monitor!and!intercept!consumers’!keystrokes).!! Some%441%brands%were%hijacked%in%April,%a%record%high%that% surpassed%the%previous%monthly%high%of%430%in%November%2012%[p.%6]% ! 2nd Quarter 2013 Phishing Activity Trends Summary ●!During!the!second!quarter!of!2013,!a!total!of!639!unique! brands!were!targeted!by!phishing!attacks.!This!number! topped!the!previous!high!of!614!seen!in!Q4!2012.![p.!6]!! ●!!Phishing!hosted!in!Russia!almost!disappeared!in!June,! replaced!by!phishing!hosted!in!Kazakhstan.!This!was!a! temporary!shift!highlighting!the!mobility!of!criminal!! infrastructure.![p.!7]!! ●!The!number!of!unique!phishing!reports!submitted!to! Table of Contents ! APWG!saw!a!steady!decrease!during!the!quarter,! Statistical Highlights for 2nd Quarter 2013 3 Phishing E-mail Reports and Phishing Site Trends ! dropping!nearly!27!percent!from!April!to!June.![p.!4]! 4 Brand-Domain Pairs Measurement 5 Brands & Legitimate Entities Hijacked by ! E-mail Phishing Attacks 6 ! Most Targeted Industry Sectors 7 Countries Hosting Phishing Sites 7 Top Malware Infected Countries 8 Measurement of Detected Crimeware 9 Phishing-based Trojans & Downloader’s Host ●!The!number!of!new!malware!samples!continues!to!rise.! In!Q2!2013,!some!12!percent!more!malware!samples!were! captured!than!in!the!same!period!last!year.![p.!8]! ●!The!online!game!sector!experienced!a!notable!drop!in! phishing,!from!5.66!percent!in!Q1!2013!down!to!2.03! percent!in!Q2!2013.![p.!7]! Countries (by IP address) 10 2! Phishing by Top-Level Domain 10 ●!In!May,!Germany!surpassed!the!United!States!as!the!top! 11 country!hosting!phishingBbased!Trojans!and!downloaders.! APWG Phishing Trends Report Contributors !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Phishing Activity Trends Report 2 nd Quarter 2013 www.apwg.org • info@apwg.org! ! [p.!10]! ! ! ! !
  • 3. Phishing Activity Trends Report, 2nd Quarter 2013 ! ! ! Methodology and Instrumented Data Sets An!eBmail!campaign!is!a!unique!eBmail!sent!out!to!multiple!users,!directing!them!to!a!specific!phishing!web!site! (multiple!campaigns!may!point!to!the!same!web!site).!APWG!counts!unique!phishing!report!eBmails!as!those!in!a! given!month!with!the!same!subject!line!in!the!eBmail.!! ! The!APWG!also!tracks!the!number!of!unique!phishing!websites.!This!is!now!determined!by!the!unique!base!URLs!of! the!phishing!sites.!(A!single!phishing!site!may!be!advertised!as!thousands!of!customized!URLS,!all!leading!to! basically!the!same!attack!destination.)!APWG!additionally!tracks!crimeware!instances!(unique!software!applications! as!determined!by!MD5!hash!of!the!crimeware!sample),!as!well!as!unique!sites!that!are!distributing!crimeware! (typically!via!browser!driveBby!exploits).!The!APWG%Phishing%Activity%Trends%Report!also!includes!statistics!on!rogue! antiBvirus!software,!desktop!infection!rates,!and!related!topics.! ! Special!Note!for!Readers!of!Q2!2013!Trends%Report:!The!APWG!continues!to!refine!its!tracking!and!reporting! methodology!and!to!incorporate!new!data!sources!into!our!reports.!APWG!has!reBinstated!the!tracking!and! reporting!of!unique!phishing!reports!(eBmail!campaigns)!in!addition!to!unique!phishing!sites!with!this!quarterly! report.!!We!plan!on!reviewing!our!metrics!and!reporting!systems!over!the!next!six!months,!in!order!to!keep!pace! with!change!in!the!environment!and!continue!to!provide!fresh!insights!to!the!public.! ! ! ! Statistical Highlights for 2nd Quarter 2013 ! Number!of!unique!phishing!websites!detected! April! May! June! 36,480! 44,511! 38,110! 20,086! 18,297! 14,698! 441! 431! 425! USA! USA! USA! 50.92%! 57.45%! 51.52%! No!hostname;!just!IP!address! 4.57%! 5.23%! 5.26%! Percentage!of!sites!not!using!port!80! 0.38%! 0.45%! 0.80%! Number!of!unique!phishing!eBmail!reports!(campaigns)!received! by!APWG!from!consumers! Number!of!brands!targeted!by!phishing!campaigns! Country!hosting!the!most!phishing!websites! Contain!some!form!of!target!name!in!URL! ! 3! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Phishing Activity Trends Report 2 nd Quarter 2013 www.apwg.org • info@apwg.org! ! ! !
  • 4. Phishing Activity Trends Report, 2nd Quarter 2013 ! Phishing E-mail Reports and Phishing Site Trends – 2nd Quarter 2013 ! The!number!of!phishing!sites!detected!fluctuated!by!nearly!10,000!sites!month!to!month!during!both!Q1!and!Q2,! with!APWG!seeing!a!18!percent!increase!from!April!to!May,!2013.!Apriles!36,480!was!the!secondBlowest!number!on! record,!a!little!higher!than!the!historical!low!of!35,024!recorded!in!February!2013.! ! ! ! ! ! ! ! ! ! ! ! ! ! ! The!number!of!unique!phishing!reports!submitted!to!APWG!each!month!saw!a!steady!decrease!during!the!quarter,! ! dropping!nearly!27!percent!from!April!to!June.!Junees!total!of!14,698!was!63!percent!lower!than!the!allBtime!high!of! ! 4! 40,621!reports,!recorded!in!August!2009.!It!is!not!unusual!for!phishing!activity!to!decline!a!bit!in!the!summer!months.! ! ! !!! ! !! ! !! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Phishing Activity Trends Report 2 nd Quarter 2013 www.apwg.org • info@apwg.org! ! ! !
  • 5. Phishing Activity Trends Report, 2nd Quarter 2013 ! Brand-Domain Pairs Measurement – 2nd Quarter 2013 ! The!following!chart!combines!statistics!based!on!brands!phished,!unique!domains,!unique!domain/brand!pairs,!and! unique!URLs.!Brand/domain!pairs!count!the!unique!instances!of!a!domain!being!used!to!target!a!specific!brand.! (Example:!!if!several!URLs!are!targeting!a!brand!–!but!are!hosted!on!the!same!domain!–!this!brand/domain!pair! would!be!counted!as!one!instead!of!several.)!Forensic%utility%of!this!metric:!If!the!number!of!unique!URLs!is!greater! than!the!number!of!brand/domain!pairs,!it!indicates!many!URLs!are!being!hosted!on!the!same!domain!to!target!the! same!brand.!Knowing!how!many!URLs!occur!with!each!domain!indicates!the!approximate!number!of!attacking! domains!a!brandBholding!victim!needs!to!locate!and!neutralize.!Since!phishingBprevention!technologies!(like! browser!and!eBmail!blocking)!require!the!full!URL,!it!is!useful!to!understand!the!general!number!of!unique!URLs! that!occur!per!domain.!! ! The!number!of!unique!brandBdomain!pairs!fluctuated!during!second!quarter!of!2013.!The!high!for!the!threeBmonth! period!was!in!May,!with!14,033!brandBdomain!pairs,!dropping!back!to!11,960!in!June.! ! %% ! % % % % % % % % % % % % % % % % % % % % ! April! May! June! Number!of!Unique!Phishing!Web!Sites!Detected! ! Unique!Domains! 44,511! 38,110! 10,849! 12,180! 10,329! ! Unique!BrandBDomain!Pairs! ! 36,480! 12,460! 14,033! 11,960! 441! 431! 425! 88.75! 103.27! 89.64! Unique!Brands! ! URLs!Per!Brand! ! 5! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Phishing Activity Trends Report 2 nd Quarter 2013 www.apwg.org • info@apwg.org! ! ! !
  • 6. Phishing Activity Trends Report, 2nd Quarter 2013 ! !Brands Targeted by E-mail Phishing Attacks – 2nd Quarter 2013 ! The!number!of!brands!targets!by!phishers!reached!an!allBtime!high!of!441!in!April,!surpassing!the!old!monthly!record! of!430!seen!in!November!2012.!!iThe!landscape!continues!to!evolve!as!fraudsters!seek!new!victims!in!untapped!markets! by!targeting!more!brands,”!said!Ihab!Shraim,!Trends%Report!contributing!analyst!and!CISO!and!Vice!President!AntiB Fraud!Engineering!and!Operations!at!MarkMonitor.!“During!the!second!quarter!of!2013,!a!total!639!unique!brands! were!targeted!by!phishing!attacks.!This!number!topped!the!previous!high!of!614!seen!in!Q4!2012.i!!! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! 6! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Phishing Activity Trends Report 2 nd Quarter 2013 www.apwg.org • info@apwg.org! ! ! !
  • 7. Phishing Activity Trends Report, 2nd Quarter 2013 ! Most-Targeted Industry Sectors – 2nd Quarter 2013 ! Payment!Services!continued!to!be!the!mostBtargeted!industry!sector.!Most!sectors!remained!consistent!with!the!first! quarter!of!2013,!except!for!computer!and!online!gaming,!which!experienced!a!notable!drop!from!5.66!percent!in!Q1! 2013!to!2.03!percent!in!Q2!2013.!! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !Countries Hosting Phishing Sites – 2nd Quarter 2013! ! ! Russia!has!traditionally!been!near!the!top!of!the!list!of!countries!where!phishing!sites!have!been!hosted.!But!in!June! 2013,!phishing!on!Russian!hosting!almost!disappeared,!with!Kazakhstan!suddenly!appearing!in!the!#2!spot:! !! April! !!!May!!!!!!!!!!!!!!!!!!!!!! June! United!States! 36.21%! United!States! 44.03%! United!States! Hong!Kong! 19.38%! Russian!Federation! 11.58%! Kazakhstan! 45.47%! 7.11%! Russian!Federation! 7.67%! United!Kingdom! 4.79%! France! 6.78%! Germany! 4.37%! Germany! 4.43%! Germany! 5.73%! Canada! 3.96%! Finland! 3.92%! Canada! 4.31%! Brazil! 3.54%! Turkey! 3.67%! United!Kingdom! 3.11%! Angola! 2.68%! Canada! 3.38%! Brazil! 2.45%! United!Kingdom! 2.42%! Brazil! 2.17%! Turkey! 1.70%! France! 2.33%! Indonesia! 1.90%! Malaysia! 1.58%! Thailand! 2.15%! Ireland! 1.56%! Ukraine! 1.40%! ! 7! “We!know!that!Kazakhstan!is!enjoying!an!uptake!in!the!adoption!of!mobile!payments,!so!it’s!not!a!surprise!that! phishers!have!sought!to!move!to!this!area,”!said!Trends%Report!contributing!analyst!Carl!Leonard!of!Websense!Security! Labs.!“A!spate!of!phishing!hosted!in!Hong!Kong!also!disappeared!in!late!April.!The!portability!of!a!phishing! infrastructure!is!wellBdocumented,!and!criminals!continue!to!attempt!to!evade!detection!and!shutBdowns!by!moving! their!infrastructure!around.”! ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Phishing Activity Trends Report 2 nd Quarter 2013 www.apwg.org • info@apwg.org! ! ! !
  • 8. Phishing Activity Trends Report, 2nd Quarter 2013 ! Crimeware Taxonomy and Samples According to Classification ! The!APWG’s!Crimeware!statistics!categorize!crimeware!attacks!as!follows,!though!the!taxonomy!will!grow!as! variations!in!attack!code!are!spawned.!Definition:!!Crimeware!is!code!designed!with!the!intent!of!collecting! information!on!the!endBuser!in!order!to!steal!the!user’s!credentials.!Unlike!most!generic!keyloggers,!phishingBbased! keyloggers!have!tracking!components,!which!attempt!to!monitor!specific!actions!(and!specific!organizations,!such!as! financial!institutions,!retailers,!and!eBcommerce!merchants)!in!order!to!target!specific!information.!The!most! common!types!of!information!are!access!to!financialBbased!websites,!eBcommerce!sites,!and!webBbased!mail!sites.! ! ! Malware Infected Countries – 2nd Quarter 2013! ! The!amount!of!new!malware!samples!continued!to!rise.!In!the!second!quarter!of!2013,!12!percent!more!unique! malware!samples!were!identified!than!in!the!same!period!last!year,!and!an!increase!of!17!percent!in!2013!so!far.! Trojans!were!the!most!popular,!accounting!for!77.2!percent!of!all!new!malware!created.!According!to!Luis!Corrons,! PandaLabs!Technical!Director!and!Trends%Report!contributing!analyst,!Trojans!have!reached!recordBsetting!popularity! as!a!form!of!malware.! ! ! Type%of%Malware%Identified% %!!of!malware!samples! Malware%Infections%by%Type% %!!of!malware!samples! ! Trojans! 77.20%! Trojans! 79.70%! ! Viruses! 11.28%! Viruses! 6.06%! ! Worms! 10.29%! Worms! 6.71%! ! Rogueware! 1.09%! Rogueware! 3.62%! ! Other! .15%! Other! 3.91%! ! ! ! ! CyberBcriminals!use!Trojans!as!a!key!tool!to!infect!users’!computing!devices,!and!continually!introduce!changes!to! evade!the!signatureBbased!detection!used!by!antivirus!firms.!The!process!is!often!automated,!changing!the!binaries!run! on!victims’!computers!and!leading!to!more!unique!signatures!and!samples.! ! PandaLabs!estimates!that!in!the!second!quarter!of!2013,!the!percentage!of!infected!computers!worldwide!was!32.77! percent,!which!was!up!on!the!first!quarter.!More!than!half!of!the!computers!in!China!are!infected.!China!was!followed! by!Turkey!(43.59%).!A!number!of!Latin!American!countries!have!infection!rates!over!the!global!average:!Peru!(42.14%),! Brazil!(35.83%),!Guatemala!(35.51%),!Colombia!(33.86%),!Costa!Rica!(33.33%),!and!Chile!(33.22%).! ! Europe!and!Japan!continue!to!have!the!lowest!infection!rates.!The!USA!fell!in!the!middle!of!the!rankings,!with!a!31.16! percent!infection!rate.!! ! Ranking Country Infection ratio Ranking! Country! Infection!Rate! ! 8! 1! 2! 3! 4! 5! 6! 7! 8! 9! 10! China! Turkey! Peru! Bolivia! Ecuador! Russia! Argentina! Taiwan! Slovenia! El!Salvador! 35! 36! 37! 38! 39! 40! 41! 42! 43! 44! 52.36%! 43.59%! 42.14%! 41.67%! 41.13%! 41.08%! 39.36%! 38.65%! 38.00%! 37.29%! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! Phishing Activity Trends Report 2 nd Quarter 2013 www.apwg.org • info@apwg.org! ! Portugal! Netherlands! Switzerland! Belgium! France! UK! Japan! Germany! Norway! Sweden! 26.79%! 25.82%! 25.60%! 24.87%! 24.54%! 24.48%! 24.21%! 24.18%! 21.14%! 21.03%! ! ! !
  • 9. Phishing Activity Trends Report, 2nd Quarter 2013 ! Measurement of Detected Crimeware – 2nd Quarter 2013 ! ! ! Using!data!contributed!from!APWG!founding!member!Websense!regarding!the!proliferation!of!malevolent! software,!this!metric!measures!proportions!of!three!genera!of!malevolent!code:!! ! • Crimeware!(dataBstealing!malicious!code!designed!specifically!to!be!used!to!victimize!financial!institutions’! customers!and!to!coBopt!those!institutions’!identities);!!! • Data%Stealing%and%Generic%Trojans!(code!designed!to!send!information!from!the!infected!machine,!control!it,! and!open!backdoors!on!it);!and!! • Other!(the!remainder!of!malicious!code!commonly!encountered!in!the!field!such!as!autoBreplicating!worms,! dialers!for!telephone!chargeBback!scams,!etc.)!! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! 9! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Phishing Activity Trends Report 2 nd Quarter 2013 www.apwg.org • info@apwg.org! ! ! !
  • 10. Phishing Activity Trends Report, 2nd Quarter 2013 ! ! Phishing-based Trojans and Downloader’s Hosting Countries (by IP address) ! In!May,!Germany!surpassed!the!United!States!as!the!top!country!hosting!phishingBbased!Trojans!and!downloaders.! This!is!the!first!time!that!Germany!has!been!ranked!at!the!top.!The!United!States!returned!to!the!top!spot!in!June.!! April! May! June! United!States! 26.80%! Germany! 28.59%! United!States! 40.66%! Switzerland! 24.58%! United!States! 27.18%! Germany! 30.42%! Germany! 18.33%! China! 8.50%! Netherlands! 4.31%! Russian!Federation! 8.01%! Russian!Federation! 6.38%! China! 4.25%! China! 3.87%! Netherlands! 6.10%! Russian!Federation! 3.35%! Ukraine! 2.78%! Switzerland! 3.99%! Rep.!of!Korea! 2.30%! Spain! 2.35%! France! 3.98%! Romania! 1.40%! Netherlands! 1.99%! Ukraine! 2.95%! Switzerland! 1.20%! 1.44%! Romania! 2.03%! France! 1.17%! 1.74%! Brazil! 1.13%! Romania! United!States! 26.80%! Spain! ! ! Phishing by Top-Level Domain ! Internet!Identity!records!the!topBlevel!domains!(TLDs)!used!to!host!phishing!sites.!FortyBfour!percent!of!domains! used!for!phishing!were!.COM!names,!up!for!42!percent!in!the!previous!quarter.!The!.COM!TLD!represents! approximately!44!percent!of!domain!names!registered!worldwide.!The!TLD!of!Brazil!(.BR)!continued!to!have!4! percent!of!phishing!worldwide,!but!only!1!percent!of!the!world!domain!name!market.!! ! ! 10! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Phishing Activity Trends Report 2 nd Quarter 2013 www.apwg.org • info@apwg.org! ! ! !
  • 11. Phishing Activity Trends Report, 2nd Quarter 2013 ! APWG Phishing Activity Trends Report Contributors ! ! ! ! ! ! Illumintel!Inc.!provides!advising! Internet!Identity!(IID)!is!a!USB and!security!services!to!topBlevelB based!provider!of!technology!and! domain!registry!operators!and! services!that!help!organizations! other!Internet!companies.! secure!their!Internet!presence.! !!! ! ! ! ! ! ! ! ! ! ! keep!our!customerse!information! ! and!IT!assets!safe!from!security! ! threats,!providing!the!most! effective!protection!with! ! ! ! Panda!Security’s!mission!is!to! ! MarkMonitor,!the!global!leader!in! enterprise!brand!protection,!offers! comprehensive!solutions!and! services!that!safeguard!brands,! reputation!and!revenue!from! online!risks.! minimum!resource!consumption.! Websense,!Inc.!is!a!global!leader! in!secure!Web!gateway,!data!loss! prevention,!and!eBmail!security! solutions,!protecting!more!than! 43!million!employees!at! organizations!worldwide.! ! ! ! ! ! ! ! ! ! ! The!APWG%Phishing%Activity%Trends%Report!is!published!by!the!APWG.!For!further!information!about!the!APWG,! please!contact!APWG!Deputy!Secretary!General!Foy!Shiver!at!404.434.7282!or!foy@apwg.org.!For!media!inquiries! related!to!the!content!of!this!report,!please!contact!APWG!Secretary!General!Peter!Cassidy!at!617.669.1123;!Te! Smith!of!MarkMonitor!at!831.818.1267!or!Te.Smith@markmonitor.com;!Luis!Corrons!of!Panda!at! lcorrons@pandasoftware.es;!Websense!at!publicrelations@websense.com,!or!ATmedia@internetidentity.com!! ! About the APWG ! PWG!thanks!its!contributing!members,!above,!for!the!data!and!analyses!in!this!report0.! Founded!in!2003,!the!AntiBPhishing!Working!Group!(APWG)!is!a!notBforBprofit!industry!association!focused!on! eliminating!the!identity!theft!and!frauds!that!result!from!the!growing!problem!of!phishing,!crimeware,!and!eB mail!spoofing.!Membership!is!open!to!qualified!financial!institutions,!retailers,!ISPs,!solutions!providers,!the!law! enforcement!community,!government!agencies,!multiBlateral!treaty!organizations,!and!NGOs.!There!are!more! than!2,000!enterprises!worldwide!participating!in!the!APWG.!Because!electronic!crime!is!a!sensitive!subject,! APWG!maintains!a!policy!of!confidentiality!of!member!organizations.! Websites!of!APWG!publicBservice!enterprises!include!its!public!website,!<http://www.antiphishing.org>;!the! Website!of!public!awareness!program,!STOP.!THINK.!CONNECT.!Messaging!Convention! <http://www.stopthinkconnect.org>!and!the!APWG’s!research!website!<http://www.ecrimeresearch.org>.!These! serve!as!resources!about!the!problem!of!phishing!and!electronic!frauds!perpetrated!against!personal!computers! and!their!users!–!and!resources!for!countering!these!threats.!The!APWG,!a!501c6!taxBexempted!corporation,!was! founded!by!Tumbleweed!Communications,!financial!services!institutions!and!eBcommerce!providers.!APWG’s! first!meeting!was!in!November!2003!in!San!Francisco!and!in!June!2004!was!incorporated!as!an!independent! 11! corporation!controlled!by!its!board!of!directors,!its!executives!and!its!steering!committee.! ! Analysis!by!Greg!Aaron,!Illumintel;!Trends%Report!editing!by!Ronnie!Manning,!Mynt!Public!Relations.! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Phishing Activity Trends Report 2 nd Quarter 2013 www.apwg.org • info@apwg.org! ! ! !