Feeds

Phishers switch focus to targeted attacks, warns Cisco

Looking for the higher-value victim

Securing Web Applications Made Simple and Scalable

Cybercrims are switching tactics from traditional email-based mass security threats to lower volume targeted attacks, according to a report by Cisco Security Intelligence Operations.

A survey of more than 360 IT bods across 50 organisations found that in the past year the cost of email-based hacks - financial, stolen credentials, remediation - fell from $1bn to $300m but but scam and malicious attacks grew from $50m to $200m.

"The business activity caused by highly-personalised targeted attacks is growing rapidly, tripling in the last year," stated the report.

A number of high profile victims include RSA, Google and Sony,

Proliferation was compounded by the shift toward mobility, uncontrolled endpoints and IT policies focusing on identifying classic threats in messages or malicious downloads.

Spam message volumes fell by 80% from 300 billion to 40 billon a day as law enforcement agencies, along with security and IT industry firms worked together to "shut down or limit the largest spam-sending botnets and their associates".

Targeted attacks, which typically use some form of malware, are aimed at a specific user or user group - customers of a bank - containing high levels of personal info gleaned from dossiers collated on social networking sites, press releases or company correspondence.

"[These] are difficult to protect against and have the potential to deliver the most negative impact to victims," said the report, adding that the value per victim is roughly 40 times higher than a mass security attack.

"Spearphishing attack campaigns are limited in volume but offer higher user open and click through rates. With these constraints, cybercriminals are increasingly focusing on business users with access to corporate banking accounts to make sure they're seeing a sufficient return per infection." it added.

The cost to organisations not limited to financials or remediation of injected hosts but to the brand reputation of the victim.

"With the number of targeted attacks expected to increase cybercriminal activity will continue to evolve, as will its impact," the report concluded. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.