August 13, 2018 By David Bisson 2 min read

A quarterly threat report revealed malicious email payloads increased in both volume and frequency between the first and second quarters of 2018.

Researchers from Proofpoint detected a 36 percent increase in malicious messages between the first and second quarters of this year, according to the August 2018 report. While this fell short of the peak volumes the enterprise security firm observed in 2016 and 2017, the report noted that this past quarter stood out for the variety of threats the researchers discovered in phishing campaigns.

Ransomware, for example, accounted for 11 percent of malicious email payloads, according to the report. While ransomware was not the dominant payload in the second quarter, bad actors are using it as part of their everyday toolkits, and attacks appear to be consolidating around major strains like GandCrab and Sigma.

Malicious Emails Carry Multiple Payloads in Q2

This trend suggests that attackers are becoming increasingly creative with their malicious payloads. In some cases, they’re sending out malware that can behave like multiple digital threats. Researchers at ThreatFabric observed this cross-functionality in June 2018 with MysteryBot, an Android banking Trojan capable of delivering a keylogger and ransomware.

Some threat actors are also launching attack domains containing multiple payloads. For example, Fortinet observed a single mass spam campaign pushing three separate samples of GandCrab version 2.1 earlier in 2018.

As a result, businesses of all sizes face a challenge to protect themselves against a wide variety of digital threats as opposed to just a few payload categories, which can consume significant time and resources.

How Can Organizations Improve Email Security?

Security experts recommend employing a layered approach to email security, which should include spam control, email scanning, security information and event management (SIEM), and other antispam controls. Security professionals should also consider using a threat intelligence platform that integrates with their email inbox to quickly share and collect threat data.

Sources: Proofpoint, ThreatFabric, Fortinet

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today