The Register reports that cyber criminals have ditched traditional email-based mass security threats in favor of lower volume targeted attacks, according to a report by Cisco Security Intelligence Operations. The reports says:
Spearphishing attack campaigns are limited in volume but offer higher user open and click through rates. With these constraints, cybercriminals are increasingly focusing on business users with access to corporate banking accounts to make sure they’re seeing a sufficient return per infection.
Cisco’s report found that spam volumes have declined from a peak of 300 billion daily messages to only 40 billion between June 2010 and June 2011. eSecurity Planet notes that revenues have also decreased from $1.1 billion in June 2010 and to $500 million in June 2011. Why the decline? Patrick Peterson, Cisco Fellow, says one reason is that botnets are being shut down. Law enforcement has also become very active in battling mass attacks.
While mass attacks are cheaper to pull off, the payoff for targeted attacks is much greater. As Dark Reading explains:
Mass-attack victims are worth about $2,000 a head, while targeted ones are valued at $80,000 each, Cisco says. The mass campaign nets eight victims, while the targeted one successfully dupes two, so in the end the targeted attack returns a $150,000 profit, versus $14,000 for the mass attack.
