CircleID

MarkMonitor has annonuced that it will be sharing a new, monthly Fraud Intelligence Report with customers and other interested parties. The goal of the report is to provide timely analysis of developing trends and new threats in the fraud landscape. The Fraud Intelligence Report will complement the current MarkMonitor analysis as provided in the semi-annual Brandjacking Index® reports and customer reports.

The headline findings of the April 2010 Fraud Intelligence Report are:

Phishing Attack Volume Continues to Grow

Phishing attack volume increased 33% to 36,557 attacks in April, continuing the growth trend from March; however, phishing attack volume has not returned to the level seen in April 2009.

Fewer Organizations Targeted

The number of targeted organizations decreased 9% to 270 in April, reversing a growth trend that began after December 2009, but the current level has returned to the level seen in April 2009.

Attacks per Organization Grow

Monthly attacks per organization grew 27% to 135 in April, suggesting a return to concentrated attacks on lucrative targets.

Payment Services Sector Continues as Most Popular Phishing Sector

The Payment Services sector was the primary sector favored by phishers, accounting for 41% of phish attacks in April. The Financial sector, historically the most popular phishing sector, accounted for 33% of phish attacks.

Social Network Phish Volume Declines

Phish targeting social networks declined 24% to 1,379 attacks in April, reversing the steep growth observed in March.

The US Continues to be Most Popular Phish Hosting Country

The US continued as the predominant country hosting phishing sites, accounting for 52% of phishing attacks in April. A notable new development was that Bulgaria grew almost 9,600% to jump from the #47 position to #2 and accounted for 6% of total phish.

An important major trend underlying the above points is that phishers have shifted their primary attack vector from fast-flux botnets to hacked websites. Phishing attacks hosted on fast-flux botnets hide behind a cloud of rapidly changing proxies but ultimately present a single point of failure — the malicious domain. Cybercriminals registered domains for multiple fast-flux phishing attacks targeting many brands. But these domains, and the multiple phishing attacks they hosted, could be detected (often preemptively), Fraudcasted, and shut down in high volumes.

In the meantime, hacked website-based phishing attacks became more prevalent. In these attacks, cybercriminals compromise legitimate domains and host their phish attacks on the subdomains. This effectively removes the single point of failure in fast-flux phishing attacks — now there is no malicious domain to detect, Fraudcast, and shut down. From the fourth quarter of 2009 onwards, the MarkMonitor Security Operations Center observed a dramatic decline in phishing attacks hosted on fast-flux botnets and an equally dramatic rise in phishing attacks hosted on hacked websites.

Download the report here: MarkMonitor Fraud Intelligence Report, April 2010

About MarkMonitor

MarkMonitor®, the world leader in enterprise brand protection and a Thomson Reuters Intellectual Property & Science business, uses a SaaS delivery model to provide advanced technology and expertise that protects the revenues and reputations of the world's leading brands. (Learn More)

Related topics: Cybercrime, Cybersquatting, Domain Names, Security, Spam