China and Romania take phishing crown from US

[nsane.forums]

Countries become top in origin of targeted attacks

The United States is no longer considered the country with the highest rate of targeted malware attacks, according to Symantec.

The company said in its most recent MessageLabs Intelligence report that when the original IP address of the attacker is considered, China is the most popular source of targeted attacks, followed by Romania and then the US.

Senior analyst Paul Wood explained that while the majority of servers used for attacks were located in the US, those who were controlling the actual malware activity were located elsewhere.

"A large proportion of targeted attacks are sent from legitimate webmail accounts which are located in the US and therefore, the IP address of the sending mail server is not a useful indicator of the true origin of the attack, " Wood explained.

"Analysis of the sender's IP address, rather than the IP address of the email server reveals the true source of these targeted attacks."

By logging the IP address of the sender, Symantec found that the US share of the targeted malware load dropped from 33.6 per cent of all targeted attacks to 13.8 per cent. The reduced share puts the company in third place internationally behind China's 28.2 per cent share and Romania's 21.1 per cent.

Researchers found that .RAR archives were the most likely attachments to contain malware infections. An estimated 96.8 per cent of .RAR email attachments were infected with malware. .XLS and .DOC files were more commonly used as attachments, but were also less likely to be infected.

View: Original Article