Fighting malware and spam

Targeted trojan attacks and industrial espionage

Alex Shipp MessageLabs

Currently our statistics show that over email we are stopping 3,000,000 items of malware a day, of which approximately 7 on average can be classified as a targeted trojan attack. This is less than 0.001% of all malware arriving by email, so should we be worried? Analysis shows that these trojans are predominantly an attempt to get data-stealing software inside an organisation, so perhaps we should.

In this paper I will run through a typical targeted attack, talk about what the attacker is trying to achieve, and how they are trying to achieve it. I will then also look at patterns and trends over the last 12 months, and try to make some predictions for the future.

I will also derive some metrics which can be used to explore if targeted attacks should be high up on a company's risk analysis awareness, even though the number of attacks is small.