Kaspersky Lab's latest Spam and Phishing Report found that spam emails have become more dangerous, even though their volume has decreased. At the same time, the level of malicious email attempts has increased dramatically. 
More specifically, in March 2016, Kaspersky Lab products blocked 22,890,956 attempts to "infect" users via malicious files contained in emails, twice the number of attempts recorded in February 2016.
Since 2012, the level of spam messages in total email volume has been continuously decreasing.
However, the volume of emails containing malicious attachments has increased significantly, with the first quarter of 2016 being 3.3 times higher compared to the same period in 2015.
There was also an increase in the volume of ransomware detected during the quarter, which is often spread via emails containing “infected” attachments (e.g. Word documents). The leading threat actor in this area during the first quarter was the ransomware Trojan Locky, which is distributed via email, in different languages, and has targeted targets in at least 114 countries. Locky emails contained fake credentials from financial institutions, tricking users into opening the malicious attachment.
Kaspersky Lab’s findings show that cybercriminals are increasingly using such messages to target Internet users as browsing the Internet becomes increasingly secure. Almost all popular browser providers have now implemented security and anti-phishing protection tools, making it more difficult for cybercriminals to spread malware via “infected” websites.
In the first quarter of 2016, cybercriminals tried to lure users into opening malicious files by attracting their attention with emails about terrorism, a topic that is always in the news. Many countries have increased security measures to prevent terrorist attacks, making this a particularly popular topic for spam emails.
Some scammers tried to convince recipients that the file attached to the spam email contained a new mobile application that could detect an explosive device, once installed.
The email emphasized that the US Department of Defense had discovered this technology and that it was quite simple and accessible. The attachment usually contained an executable file, which is identified by the codename “Trojan-Dropper.Win32.Dapato”. This malware can steal users’ personal information, organize DDoS attacks and install other malware.
Even scammers using the well-known Nigerian spamhave resorted to using terrorism-related topics in their emails. According to the Kaspersky Lab report, the volume of such emails has increased significantly.
These spammers used to prefer sending long emails that contained a detailed story and links to news stories to make themselves more persuasive. However, they now only send short messages, without details, asking recipients to get in touch with them.
“Unfortunately, we are seeing our previous predictions about the criminalization of spam coming true. Fraudsters are using different methods to attract users’ attention and break down their defenses. Spammers are also using various languages and social engineering methods, multiple types of malicious attachments, as well as partial personalization of email text to make them look more convincing. Fake messages often imitate notifications from well-known organizations and services. All of the above means that spam is moving to a new, dangerous level,” warns Daria Gudkova, Spam Analysis Expert at Kaspersky Lab.
More information about the spam and phishing landscape for the first quarter of 2016 is available on the Securelist.com.
