Spam in December 2011: ‘conditional coupons’ and increasingly malicious mass mailings

Kaspersky Lab announces the publication of its spam report for December 2011. The last month of the year was predictably quiet – compared to November the share of spam in email traffic fell 4.4 percentage points and averaged 76.2% for the month.

The lull in business in the run-up to the holidays means botnets are hamstrung by empty offices and silent computers, while the spammers themselves often take a break for the festive season. However, even the approach of Christmas doesn’t prevent them from coming up with new tactics to attract users to their mass mailings. One of the latest ploys has been the use of coupon services to boost demand for products that are widely advertised in spam. Distributors of German pharmaceutical spam concluded that offering a 'conditional coupon' with a 10% discount would increase demand for the medications they sell.

“We still have not detected any malicious attachments disguised as coupons, although we expect that these will show up in spam sooner or later,” warns Maria Namestnikova, Senior Spam Analyst at Kaspersky Lab. “Anything and everything that is in demand on the Internet is eventually added to the spammers' arsenals in one way or another. Primarily, new approaches are typically used by the participants of affiliate programs that send out spam advertising medications and replicas of luxury goods. They are later joined by distributors of malicious code.”

Malicious files, by the way, were detected in 4% of all email traffic in December, which was an increase of 1 percentage point compared to November’s figure.  A third of all Kaspersky Lab email antivirus detections were for mail emanating from Russia and the US. The malicious program most frequently detected remains Trojan-Spy.HTML.Fraud.gen (11%) – a Trojan designed to look like a registration web page for a financial organization or some other online service. When it came to spam sources in December, India remained on top, accounting for 12.43% of all spam, followed by Indonesia, Brazil and Peru. Significant movers among this particular rating in December were South Korea falling from second to fifth place and the UK, which fell from seventh to seventeenth. Remarkably, the latter started the month as the eighth biggest source of spam but had fallen to 53^rd by the final week of December.