2013 was a year of change in the spam landscape.

The volume of spam increased from 2012. We witnessed the decline of a previously-successful exploit kit. The old became new again, thanks to different techniques used by spammers. While we still saw traditional types of spam, we also saw several “improvements” which allowed spammers to avoid detection and victimize more users. We also saw spam utilized more to carry malware since the start of the year.

Figure 1. Spam volume from 2008

The Slow Death of the Blackhole Exploit Kit

The Blackhole Exploit Kit (BHEK) is a notorious exploit kit that was widely used in numerous spam campaigns.  This exploit kit was highly adaptive, incorporating vulnerabilities, current “hot topics,” and even social networks into several campaigns.

In 2013, we saw 198 BHEK spam campaigns, a smaller number compared to the previous year. The volume may have lessened but this didn’t make such campaigns less effective. For example, we saw spammed messages just hours after the official announcement of the birth of the “Royal Baby.”  In this particular spam run, the volume of spammed messages reached up to 0.8% of all spam messages collected during the time period.

Figure 2. Number of BHEK campaigns from March 2012 to December 2013

The end of the third quarter was marked by the arrest of Paunch, a person believed to be the creator of the BHEK. We noted that in the two weeks after his arrest, we found no significant BHEK spam runs. The number of BHEK spam runs dwindled until there was none in December.

Health Spam Spikes

Entering the third quarter, we noticed an increase in the number of health-related spam. At one point, this type of spam constituted 30% of all spam we saw, with over two million samples spotted daily. The content of these messages ran the gamut from weight loss tip to pharmaceutical products.

What’s notable about this particular spam run is that these messages have evolved from using traditional “direct” approaches (with an image of the product and call-to-action to buy) to more “subtle” methods. Health spam now uses a newsletter template to peddle products. The purpose of the newsletter template may be two-fold: to avoid detection by anti-spam filters and to appear more legitimate to users. Several messages even claimed to be from reputable news sources such as CBS, CNBC, CNN, the New York Times, and USA Today.

Figure 3. Sample health-related spam

These messages were sent from computers in various countries, including India (10%), Spain (8%), Italy (7%) and the United States (6%).

The spike wasn’t the only notable health spam we saw this year. We also saw several spammed messages that leveraged the controversial Affordable Care Act or Obamacare, even before it was officially launched. Once users click on the links in these messages, they were led to survey scam sites.

The Change in Malware Attachments

Aside from advertising and selling pharmaceutical products, spam is also used to distribute malware. Even though there may be more complex ways of infecting systems, the use of malware attachments remains constant in the threat landscape. This suggests that there are users who still fall prey to simple techniques (such as urging users to click on an attachment). We noticed that the number of spam with malicious attachments fluctuated throughout the year, before it steadily increased in the latter months.

Figure 4. Volume of spam messages with malicious attachments

From the first to third quarter of the year, ZBOT/ZeuS was the top malware family distributed by spam. This family is known for stealing financial-related information. Halfway into the third quarter, however, we noticed that TROJ_UPATRE unseated ZBOT and became the top malware attachment. In November, about 45% of all malicious spam with attachments contained UPATRE malware.

UPATRE became notorious for downloading other malware, including ZBOT malware and ransomware, particularly CryptoLocker. This type of attack is doubly risky for users because not only will their information be stolen, their files will also become inaccessible.

Spam, 2014 and Beyond

We anticipate that the 2013 spam landscape will set a precedent for the threats we’ll see in the upcoming year:

• Spammers will blend old spam techniques in order to avoid detection and successfully victimize users.
• Spam will still be used to spread malware.
• Social networking spam will experience a drastic increase in terms of spam volume.

You may read our upcoming annual year-end report for more information and insights about spam and other elements about the threat landscape in 2013.

Nelson Mandela, one of Africa’s most recognizable figures, passed away last December 5. This unfortunate event did not stop cybercriminals from spewing their usual spam campaigns, this time attempting to leverage the African leader’s demise. What is interesting is that even before Mandela’s death, spammers were already using his name to capture users’ attention. Typically, scammers spur such campaigns after a newsworthy event occurred, but we already saw an activity even before Mandela’s passing. We found this particular sample in November:

Figure 1. Sample of spam found before Mandela’s death

The said email is purportedly from the “Nelson Mandela Foundation”. In the said message, recipients are informed that they are one of the winners of a significant cash prize (more than $5.5 million).  To claim the money, users must provide their full name, address, and other personally-identifiable information (PII) and send these to a specific email address. After Mandela’s death, we found another spam campaign that is essentially a copycat of the previous spam we cited, though with minor modifications.

Figure 2. Sample of spam found after the African leader’s death was announced

Providing these information can be risky for users, as spammers may use these in their other, more menacing schemes. These spam are reminiscent of the classic Nigerian or 419 scams, which are known to offer users a chance to profit from a money transfer in exchange of their bank information. This scam eventually took on other forms, which include fake London Olympics and FIFA World Cup promos.   Though dated, the scam remains a staple in the threat landscape. Just recently, we found  several Ice IX servers that are also engaged in distributing Nigerian scams.

An effective spam campaign is not just defined by the exploit employed or the sophistication of the malware component. The strength of the social engineering lure can be a deciding factor whether a user would unwittingly fall into cybercriminals’ trap or not. This typically falls on the ability of the campaign to tap into users’ vulnerability such as their emotions and curiosity.

Mandela’s popularity, the news of his death, and the promise of cash prize may be convincing enough for some users to act against their better judgment, like divulging information to unverified parties. The same can be said to the recent typhoon Haiyan scams found on Facebook and spam campaigns.

To avoid this ruse, users must always be wary of the email messages they receive. If the message comes from an unknown source or is offering something too good to be true, it is best to delete it from your inbox. Trend Micro protects users from this threat by blocking such messages. For more information on how social engineering works, you may read our paper here.

In the past few weeks, we’ve seen drastic and noteworthy increases in the number of health-related spam in the wild. Prior to September, this type of spam was relatively rare. However, as September began, these suddenly increased. Over the next few weeks, health-themed spam constituted 30% of the spam we saw, with an average of more than 2 million samples seen daily.

These messages use different forms and templates, including online articles about losing weight, high-profile newsletters, and downright email advertisements peddling fake fitness products. Many of these messages claim to be from reputable news organizations like CBS, CNBC, CNN, the New York Times, and USA Today.

Figures 1 and 2. Medical-themed spam messages

They contain links that may lead users to a variety of dubious sites, including those selling fake products or involved in survey scams. Our research indicates that these messages were sent from a variety of countries, including India (10%), Spain (8%), Italy (7%) and the United States (6%).

Overall, we’ve seen that these spam messages link to almost half a million distinct URLs.  However, these multiple URLs resolve to relatively few IP addresses. Two countries – the United States and Japan – accounted for the vast majority of traffic to these IP addresses:

Figure 3. Distribution of user traffic

We continue to look for indicators to determine the cause of this increasing traffic. It’s worth noting that this took place right after the Blackhole Exploit kit author’s arrest and the start of the registration period for the Affordable Care Act/Obamacare in the United States.

Health and fitness is one of the common social engineering themes used by spammers to lure users into their schemes. Aside from the typical pharmaceutical company newsletter and weight-loss types, cybercriminals have tried using topics like Obamacare and even laboratory results.

The continuous presence of this threat shows that spam is still a crucial part of today’s threat landscape. Users should remain extremely careful when opening messages from unverified sources. Relying on an email’s appearance is no longer an effective method for separating the wheat from the chaff. Trend Micro is continuously working to detect these threats.

With additional insights from Paul Pajares

As enrolment for the controversial Affordable Care Act or Obamacare starts today, cybercriminals already had a head start, spewing Obamacare-related spam as early as first weeks of September.

Spam containing the terms “medicare” “enrollment” “medical insurance” started surfacing during the first week of September. Some of these spam variants can be easily recognized as such. However, others appear professional enough to fool some users into opening the email and clicking the links in these messages.

Figure 1. Sample Obamacare spam

Once users click these links, they are lead to nefarious pages, in particular survey scam sites. These sites typically encourage users to disclose certain information by pretending to be consumer survey pages or promising enticing prizes or in this case, Apple products like iPad, iPhone 5 etc.

Figure 2. Sample survey scam page

Given spammers history of shrewdly using noteworthy events (iPhone 5s launch, the birth of the Royal baby), it comes as no surprise that Obamacare-related spam are making headway. Because of Obamacare’s novelty and impact, this may create confusion among American users. Spammers, unfortunately, see this as an opportunity to lure users into their schemes and disclosing personal information such as name, address, email address and the likes. The bad guys can either sell these to other cybercriminals or be used in other, more menacing threats.

For users, it is important to always to double-check email messages and bookmark reputable sites to avoid visiting fake or malicious ones. To know more how spammers and cybercriminals use social engineering and how they earn from your personal information, you may read our report How Social Engineering Works. Trend Micro protects users from this threat by blocking the related spam and websites.

In our 2Q Security Roundup, we noted the resurgence of online banking malware, in particular the increase of ZeuS/ZBOT variants during the quarter. While ZeuS/ZBOT has been around for some times, its prevalence shows that it is still a big threat to end users today.

For the month of August, 23% of spam with malicious attachments were found carrying ZeuS/ZBOT variants, while 19% served FAREIT variants.

ZeuS/ZBOT variants also had the distinction of being the most distributed malware by IPs related to spam botnets. It is also associated with various worm families that can spread itself or other malware families via email. A system infected with ZeuS/ZBOT may be infected about five other worm variants like WORM_MYDOOM, WORM_VB, and WORM_BAGLE.

Figure 1. Malware families spread by spam

Compared to others, the majority of spam carrying either ZeuS/ZBOT or FAREIT looked more like legitimate messages, and were likely to supposedly come from well-known brands or companies.

Figure 2. Sample FAREIT spam

Figure 3. Sample ZeuS/ZBOT spam

Once installed, Zeus/ZBOT variants are known to monitor users’ browsing behavior pertaining to visits to specific online banking sites. If users visit these sites and try to login using their credentials, the malware inject additional field for users to fill out and then steal these information. Cybercriminals can then use these stolen data to either initiate unauthorized transactions or sell in the underground market.

FAREIT is another data-stealing malware that gathers emails and FTP login credentials. This malware can also download other malware variants, including Zeus/ZBOT. Previously, we saw a UK tax-themed spam that delivers a FAREIT variant, which also downloads a ZBOT malware.

Trend Micro blocks the spammed messages and detects the malware cited in this blog post. It is important for end users to know how to tell apart legitimate email from spam, particularly those that use well-known brands as a social engineering lures. Best computing practices, such as being wary of attachments from unverified email, can come a long way when it comes to protecting your system and information.