MESSAGING
ABUSE ANDTHREAT TRENDS
Kevin San Diego
Cloudmark Product Management
November 8, 2018
CONFIDENTIAL

1st General Meeting1© 2018 Proofpoint, Inc.

450+ Million Protected Email / Mobile Users Worldwide
5+ Billion Messages Scanned Daily
15 Second Live Threat Updates
100+ Security Threat Operations & Researchers120+ ISP, Mobile Network Operators & Hosting Customers
98% Customer Retention

CONFIDENTIAL

2© 2018 Proofpoint, Inc.

Changes in Domain
Name Registrations
 Explosion of Generic Top-Level
Domains (gTLDs)
 Registrars offer bulk discounts forgTLD registrations

Top 30% of gTLDs seen in 2018
send 90+% Malicious Content.
Source: Cloudmark Authority, +10,000 registered domains

CONFIDENTIAL

3© 2018 Proofpoint, Inc.

Threat Trends:
Japan vs. Rest-of-WorldCONFIDENTIAL

4© 2018 Proofpoint, Inc.

Overall and Spam Message Rates Globally
120

35.0%

100

30.0%
25.0%

Billions

80

20.0%
60
15.0%
40

10.0%

20

5.0%

0

0.0%
Mar

AprMayJun

Jul

Aug Sep

Oct

Nov Dec

Jan

2017
Total Messages

FebMar

AprMayJunJulAug

5© 2018 Proofpoint, Inc.

2018
Total Spam Messages
CONFIDENTIAL

Spam % of Total Messages

Overall Spam Message Rates in Japan
40.0%

635.0%

530.0%

Billions

425.0%
20.0%

315.0%

210.0%
1

5.0%
0.0%

0Mar

AprMayJun

JulAug

Sep

Oct

Nov

Dec

Jan2017
Total Messages

Feb

Mar

AprMayJunJulAug

6© 2018 Proofpoint, Inc.

2018
Total Spam Messages
CONFIDENTIAL

Spam % of Total Messages

Phishing
Ratio (1 Phish in every n Spam)
1/1
1/1
1 / 10,000
1 / 20,000
1 / 30,000
1 / 40,000
1 / 50,000
1 / 60,000
Sep

Oct

Nov

Dec

JanFeb

2017

Mar

AprMayJun

JulAug2018

Phishing Rate Globally (1 in x)
CONFIDENTIAL

Phishing Rate in Japan (1 in x)
7© 2018 Proofpoint, Inc.

Malware Messages as Percentage of Unwanted
Messages
1.4%
1.2%
1.0%
0.8%
0.6%
0.4%
0.2%
0.0%
Mar

Apr

MayJunJulAug

SepOctNov

Dec

JanFebMar

2017

AprMayJun

JulAug2018% Malware in Globally
CONFIDENTIAL% Malware in Japan8© 2018 Proofpoint, Inc.

Main TLDs Observed in Spam Call-To-Action URLs
25.00%

20.00%

15.00%

10.00%

5.00%

0.00%

CONFIDENTIAL

9© 2018 Proofpoint, Inc.

DMARC Deployment
Examining Companies in the Nikkei 225CONFIDENTIAL

10© 2018 Proofpoint, Inc.

DMARC Deployment Statistics in Japan
Analysis of Nikkei 225

95% ofNikkei 225
Companies
Have NotDeployed
DMARC

5% Have DMARC Deployed* Asahi Glass Eisai Fast Retailing Mitsubishi Estate Mitsubishi UFJ Financial
 Mizuho Financial
 NTT DATA Olympus
 Rakuten
 Sumitomo Mitsui Trend Micro*All are in “p=none” mode

CONFIDENTIAL

11© 2018 Proofpoint, Inc.

Phishing Threat Trends

CONFIDENTIAL

12© 2018 Proofpoint, Inc.

“I Hacked You” Bitcoin Extortion Scheme
Bitcoin Ransomware Detected Per Day

 Social Engineering scheme Fakes “From:” header
 Threatens to release embarrassing
information unless ransom paid inBitcoin

250,000

900,000
800,000

200,000

700,000
600,000

 Exploiting email/password dumps
 In many examples, user’s
password listed in “Subject:” line

 Very little technical investment
required, but campaign has
collected over ¥12,000,000 in justa month

150,000
500,000
400,000
100,000
300,000
200,000

50,000100,000
0
5/31/18

6/30/18

7/31/18

Globally

CONFIDENTIAL

8/31/18

9/30/180
10/31/18

Japan13© 2018 Proofpoint, Inc.

Apple Credential Phishing “Account Disabled” phish
 Prompt users to “log in” to reestablish account Other attacks also include malwarepayloads

 Once hackers have credentials:
 Hold user device data for ransom(can wipe) Leverage mac.com/icloud.com
email access to reset other 3rdparty passwords

CONFIDENTIAL

14© 2018 Proofpoint, Inc.

LINE Credential Phishing Social Engineering scheme Spoofed “From:” header
 Message appears to be plain text

 Obfuscated URL
 Redirects to a look alike domain Attackers seeking credentials
 Likely used for account hijacking
 Extortion
 “Friend” phishing

CONFIDENTIAL

15© 2018 Proofpoint, Inc.

CONFIDENTIAL

16© 2018 Proofpoint, Inc.

CONFIDENTIAL

17© 2018 Proofpoint, Inc.

Daily Spam & Virus Activity Q1-Q2 2018
70%

30%

Majority of Messages Stopped using
Policy and Reputation Filtering

4B+ Messages
Content
ScannedActivity detected by Cloudmark Authority.

CONFIDENTIAL

18© 2018 Proofpoint, Inc.

Daily Spam & Virus Activity Q1-Q2 2018~15%(+500M – Blocked by ContentFiltering)70%

Majority of Messages Stopped usingPolicy and Reputation Filtering~15%
Delivered

Activity detected by Cloudmark Authority.

CONFIDENTIAL

19© 2018 Proofpoint, Inc.

Cryptojacking invitations: COINHIVE Events
Hijacks computerresources to mine forcryptocurrency.
Undetected by anti-virus.
Targets users
indiscriminately.
CONFIDENTIAL

20© 2018 Proofpoint, Inc.

Timeline of Cryptocurrency Mining Malware

Coinhive

Source: Proofpoint Quarterly Threat Report Q22018.

CONFIDENTIAL

21© 2018 Proofpoint, Inc.

Coinhive IDS Events

Source: Proofpoint Quarterly Threat Report Q22018.

Coinhive cryptomining events jumped 460% vs Q1 2018
CONFIDENTIAL

22© 2018 Proofpoint, Inc.