The Symantec Intelligence Report provides analysis of cyber security threats from May to June 2012. Some key findings include a 24% increase in targeted attacks, over 36% of which targeted small businesses. 45% of targeted attacks were aimed at the defense industry. Spam rates decreased slightly while phishing and malware in emails increased slightly. Adult content remained the top category for spam. Banking was the most spoofed sector in phishing attacks. Various malware like W32/Bredolab and Trojans were among the most frequently blocked.

1. Symantec Intelligence Report
June 2012
Symantec Intelligence 1

2. About the Symantec Intelligence Report
The Symantec Intelligence report provides the latest analysis of
cyber security threats, trends and insights from the Symantec
Intelligence team concerning malware, spam, and other
potentially harmful business risks.
The data used to compile the analysis for this combined report
includes data from May and June 2012.
Symantec Intelligence 2

3. October 2011 Highlights
• 36% of targeted attacks directed at SMBs
• Further analysis of W32.Flamer
• In-depth look a recently attempted targeted attack
• Spam – 66.8 percent (a decrease of 1.0 percentage point since
May 2012)
• Phishing – One in 467.6 emails identified as phishing (an
increase of 0.04 percentage points since May 2012)
• Malware – One in 316.5 emails contained malware (an increase
of 0.04 percentage points since May 2012)
• Malicious Web sites – 2,106 Web sites blocked per day (a
decrease of 51.7 percent since October 2011)
Symantec Intelligence 3

4. Targeted Attacks in 2012
• Daily targeted attacks increased by a minimum of 24%.
• More than 36% of all targeted attacks are aimed at small
companies, compared to 18% at the end of 2011.
• Direct correlation between a rise in attacks against small
companies and a drop in attacks against larger ones.
• 45% of all targeted attacks are aimed at the Defense industry.
• In four of the top five source countries, their own country is
either the first or second-most targeted country.
Symantec Intelligence 4

5. Spam Rate & Sources
5

6. Symantec Intelligence ‹#›

7. Additional Spam Metrics
Spam URL TLD Distribution
Change
TLD June May
(% points)
.com 74.7% 66.6% +8.1
.ru 4.1% 7.5% -3.4
.net 4.6% 5.8% -1.2
.br 2.9% 3.4% -0.5
Average Spam Message Size
Change
Message Size June May
(% points)
0Kb – 5Kb 43.1% 51.1% -8.0
5Kb – 10Kb 33.3% 29.1% +4.2
>10Kb 23.6% 19.8% +3.8
Symantec Intelligence 7

8. Spam Subject Line Analysis
June 2012 No. of May 2012 No. of
Rank Total Spam: Top Subject Lines Days Total Spam: Top Subject Lines Days
1 Delivery Status Notification (Failure) 28 Save-8O%-0ff-Viagra©-Cia1is©-Levitra© 28
2 Save-8O%-0ff-Viagra©-Cia1is©-Levitra© 28 (blank subject) 30
High-End-Designer-Watch-Replicas-Save-
3 (blank subject) 28 22
THOUSANDS-2012-Models
HIGH-QUALITY-ROLEX-REPLICA-
4 My Sexy Pics 28 17
WATCHES&DESIGNER BAGS
ADD THREE INCHES TO YOUR MANHOOD
5 0 5 19
NOW!
We cant make it ANY EASIER toget LAID
6 16 Order confirmation 8
tonight
HIGH-QUALITY-ROLEX-REPLICA- Hey, You Need To Cum Check out My FucBook
7 23 14
WATCHES&DESIGNER BAGS Page! :)
8 look at my photos 13 Undelivered Mail Returned to Sender 30
9 Buy Viagra/Cialis Online! 3 look at my photos 7
10 ENLARGE YOUR MANHOOD 2-4 INCHES 22 Erika Sent You A Message 7
Symantec Intelligence 8

9. Additional Spam Metrics
Global Spam Categories
Category Name June 2012 May 2012
Adult/Sex/Dating 64.28% 70.16%
Pharma 18.76% 19.22%
Casino 5.24% 0.88%
Jobs 4.72% 3.47%
Watches 2.94% 3.45%
Software 1.67% 1.78%
Degrees 0.47% 0.57%
419/Scam/Lotto 0.27% 0.13%
Mobile 0.09% 0.14%
Newsletters 0.08% 0.03%
Weight Loss <0.01% 0.08%
Symantec Intelligence 9

10. Phishing Rate & Sources
10

11. Phishing Rate & Sources
11

12. Tactics of Phishing Distribution
Automated Toolkits 55.5%
Other Unique Domains 36.9%
IP Address Domains 2.8%
Free Web Hosting Sites 4.0%
Typosquatting 0.8%
Symantec Intelligence 12

13. Organizations Spoofed in Phishing Attacks, by Industry
Sector
Banking 46.1%
E-Commerce 34.9%
Information Services 15.0%
Retail 1.4%
Communications 1.1%
Telecommunications 0.919%
Government 0.439%
Retail Trade 0.078%
Security 0.048%
Insurance 0.019%
ISP 0.011%
Symantec Intelligence 13

14. Virus Rate
14

15. Most Frequently Blocked Email Malware
Malware Name % Malware
W32/Bredolab.gen!eml.k 17.43%
W32/Bredolab.gen!eml.j 9.49%
Link-Exploit/Spam-3a71 3.82%
W32/NewMalware!16a0 3.48%
Exploit/Link-generic-ee68 3.22%
W32/NewMalware-Generic-a2a1-3477 2.34%
HTML/JS-Encrypted.gen 1.69%
Trojan.Bredolab 1.56%
W32/Bredolab.gen!eml-01cd 1.52%
Link-Gen:Variant.Barys.1516.dam 1.43%
Symantec Intelligence 15

16. New Malware and Spyware Sites Per Day
Symantec Intelligence 16

17. Policy, Malware & Potentially Unwanted Programs
Symantec Intelligence 17

18. Most Frequently Blocked Malware at the Endpoint
Malware Name % Malware
WS.Trojan.H 29.06%
W32.Sality.AE 6.81%
W32.Ramnit!html 6.01%
W32.Ramnit.B 5.61%
W32.Downadup.B 3.82%
W32.Ramnit.B!inf 3.53%
W32.Virut.CF 2.07%
Trojan.ADH.2 2.00%
W32.Almanahe.B!inf 1.83%
Trojan.ADH 1.43%
[1] For further information on these threats, please visit: http://www.symantec.com/business/security_response/landing/threats.jsp
Symantec Intelligence 18

19. Where to next?
• Web:
– www.symanteccloud.com/intelligence
– www.symantec.com/spam
• Twitter:
– @symanteccloud
Symantec Intelligence 19