Symantec reveals another huge leap in email-borne polymorphic malware

Security experts are warning of yet another rise in email-borne polymorphic malware written especially to bypass traditional anti-virus tools.

Symantec.cloud revealed in its September 2011 Symantec Intelligence Report that 72 per cent of all email-borne malware during the month could be described as an aggressive form of polymorphic malware.

This type of threat has become increasingly popular among cyber criminals since the summer. The figure stood at 23.7 per cent in July, more than double that of six months previously.

Symantec.cloud senior analyst Paul Wood explained that this type of malware is more difficult for traditional filters to detect as it constantly changes its code.

"Many anti-virus products will employ emulation techniques that allow the malware to partially run in a controlled sandbox environment," he told V3.

"The latest strains of polymorphic malware we identified include mechanisms for changing the start-up code in almost every version of the malware, subtly changing the structure and making it harder for emulators to recognise the code as malicious."

The criminal world is also looking to make email-based attacks more successful by increasing the sophistication of social engineering efforts.

"The social engineering behind many of these attacks has widened, from subjects that included fake money transfers, parcel delivery failure alerts, social networking password changes and notifications of overdue payments on credit cards," said Wood.

"The more recent attacks include examples of emails that purport to come from a smart printer using an email-to-scan facility, where a scanned document is emailed as an image or document attachment. This is the first time we have seen this particular tactic employed."

In other news, spam levels remained steady in September, although malicious spam containing links to compromised WordPress and other sites has been noticeable.

Web-based malware threats increased by one per cent, while phishing emails were down by 0.26 per cent on the previous year, said Symantec.