July 31, 2018 |

Spam Is Still the Choice of Online Criminals, 40 Years Later

Spam is the number one source of malware as criminals add a few new tricks to this classic method, new research from F-Secure and MWR InfoSecurity finds.

Helsinki, Finland—July 31, 2018: Online criminals have gotten savvier but they’re still relying on the same old tricks they’ve been using for decades. F-Secure research shows spam remains the most common method of spreading malicious URLs, scams and malware more than 40 years after the first email spam was sent.*

“Email spam is once again the most popular choice for sending out malware,” says Päivi Tynninen, Threat Intelligence Researcher at F-Secure. “Of the spam samples we’ve seen over spring of 2018, 46% are dating scams, 23% are emails with malicious attachments, and 31% contain links to malicious websites.”

Spam has been one of the main infection vectors for decades, Päivi notes. “During the past few years, it’s gained more popularity against other vectors, as systems are getting more secure against software exploits and vulnerabilities,” she says.

The technique still relies on spewing out massive numbers of emails in order to snare a tiny number of users. And criminals continually refine their tactics to deliver to better results.

“Spam is becoming an increasingly successful attack vector, with click rates rising from 13.4% in the second half of 2017 to 14.2% in 2018,” says Adam Sheehan, Behavioral Science Lead at MWR InfoSecurity, the creators of phishd, a service that monitors and improves businesses’ susceptibility to phishing and other data-related attacks. MWR was acquired by F-Secure in June of 2018.

While spam is a numbers game, MWR’s effectiveness model has identified certain tactics that play on recipients’ psychology to make spam more potent:

  • The probability of recipient opening an email increases 12% if the email claims to come from a known individual
  • Having a subject line free from errors improves spam’s success rate by 4.5%
  • A phishing email states that its call to action that is very urgent gets less traction than when the urgency is implied

Criminals are not just relying on the content of spam to trick users. They are also using new methods to infect users who are wise to the dangers of clicking on unsolicited attachments.

“Rather than just using malicious attachments, the spam we’re seeing often features a URL that directs you to a harmless site, which then redirects you to site hosting malicious content. The extra hop is an analysis evasion method for keeping the malicious content hosted for as long as possible,” Päivi says. “And when attachments are used, the criminals often attempt to avoid automatic analysis by asking the user to enter a password featured in the body of the email to open the file.”

You can hear Päivi and her fellow researcher Jarkko Turkulainen discuss spam and other current cybercrime trends on the latest episode of F-Secure’s Cyber Sauna podcast.

*https://www.npr.org/templates/story/story.php?storyId=90160617

More information

Why Spam is On the Rise — AgainDon’t be fooled: these companies are the most-spoofed in spam

 

About F-Secure

Nobody knows cyber security like F-Secure. For three decades, F-Secure has driven innovations in cyber security, defending tens of thousands of companies and millions of people. With unsurpassed experience in endpoint protection as well as detection and response, F-Secure shields enterprises and consumers against everything from advanced cyber attacks and data breaches to widespread ransomware infections. F-Secure’s sophisticated technology combines the power of machine learning with the human expertise of its world-renowned security labs for a singular approach called Live Security. F-Secure’s security experts have participated in more European cyber crime scene investigations than any other company in the market, and its products are sold all over the world by over 200 broadband and mobile operators and thousands of resellers.

 

Founded in 1988, F-Secure is listed on the NASDAQ OMX Helsinki Ltd.

f-secure.com | twitter.com/fsecure | facebook.com/f-secure

F-Secure media relations

Sandra Proske
Director, Global Corporate Communications
+49 176 700 36664

Social Media
Press Archives
Select Year

Latest Press Releases

November 21, 2019

Why AI will be Inhuman

F-Secure’s new research project uses inspiration from nature to take AI where no machine has gone before.

November 5, 2019

F-Secure garners “superior technical skills” recognition in recent industry evaluation report

The evaluation is the first to assess F-Secure’s newly-formed consultancy unit.

October 17, 2019

F-Secure weighs in on prpl Foundation security standards

F-Secure continues to drive safe IoT for consumers, bringing order to chaos in a fragmented connected home world.

October 16, 2019

MITRE ATT&CK evaluation confirms F-Secure’s industry-leading capabilities in detecting advanced attacks

The results establish F-Secure’s EDR technologies as a rock-solid foundation for building comprehensive detection and response capabilities, going beyond MITRE’s framework.

%d bloggers like this: