It’s a good news, bad news situation.
How many times have you heard that one? Well, if you’ve been following the slimy trail left by spammers over the past few years, the answer is probably a lot. When last we visited Kasperky Labs’ seasonal spam report, spam was on the rise, clocking in at more than 70% of all emails being sent. That was the gist of the Q2 2013 spam report, and the organization’s latest report, the Q3 2013 version, spam emails appear to be down a bit, but as you might expect, the good news isn’t all that good, and the bad news, well, it’s bad.
The short version is that spam email showed a 2.4% decline over the previous quarter, coming it at 68.3%. While not a significant figure in terms of the overall impact of spam on our inboxes, it’s a bit promising. We should note that it’s not the first time that we’ve seen a decline, and there does seem to be a trend as the amount of spam is heading in the right direction – down. But the number of emails with malicious attachments – the real danger in spam email – is going in the wrong direction. Kaspersky detected the nasty stuff in 3.9% of all emails, up 1.6 percentage points over Q2 2013, and up 0.5% over the entirety of 2012.
And then the news gets worse. Phishing emails clocked in as accounting for 0.0071% of all emails sent in Q2, and while that may sound like an insignificant number, Kaspersky reports that it’s triple the number of phishing messages from Q2.
At first blush, we can decipher what’s happening here using some simple logic. It’s not surprising that the overall spam numbers are on a steady decline. The mass message methodology employed by spammers for years has its place, to be sure. For a long time, it was a numbers game, with the idea that the more nets thrown out into the wild, the greater the number of victims the spammers would ensnare. But as we all know, spammers have gotten smarter (although the bar wasn’t really that high to begin with). The scattershot shotgun approach to spamming has taken on a whole new meaning, with mass spam attacks like spam blizzards being used to obfuscate other illegal activity, and nonsense messages clogging up anti-spam filters so legitimate messages are lost in the mire.
Another logical assumption about the reduction in email spam is that spammers are now more inclined to employ multiple methods, ‘spampaigns’ that utilize multiple technologies like SMS and social networking. Why settle for one method when you can all-out blitz every point of contact for humans?
As for the increase in malware, we’ve known for a while that the landscape has become increasingly dangerous. With Blackhole 2.0 in full bloom and botnets like Cutwail and Zeus wreaking havoc, it’s not surprising that the spammers continue to use malicious code to achieve their goals. Spam is very big business, so don’t expect the malicious code to go away any time soon. Of course, the practical offshoot here is that you need to keep your people informed – constantly – about the dangers of links, whether they be nested in an email message, lurking on an iPhone, or snuggled up inside a fake Tweet. It’s human nature to want to push that button or click that link, and as much as we’d like everybody to be as smart as us (well, not really, because then we’d be marginalized), it’s just not going to happen.
And then there’s phishing, the dark stranger that comes knocking at our doors with promises of preserving our accounts, protecting our information, and keeping us safe. This is the one you really need to watch out for. Kaspersky reports a 300%+ increase over last quarter, and we can glean a few things from that. First, we all know that phishing is lucrative, netting the phishers nearly three quarters of a billion dollars in the first half of 2012, according to RSA. So lucrative, in fact, that there are those out there who’ve upped the ante, if Kaspersky’s numbers are even close to representing an actual picture of the state of spam. And if the second quarter saw such a dramatic increase, what can we expect from the fourth quarter of 2013? The holiday season in full swing, people tend to be very distracted from October through December.
A likely time for a strike, if you’re a sleazebag spammer.