Each month our Spam and Virus Email Protection partner, Proofpoint Essentials, provides us with a Threat Spotlight.
Threat Spotlight August – Unique URLs
Previously, Proofpoint researchers had uncovered techniques attackers use to thwart detection and increase delivery rates. These included: rotating through a large number of IP addresses, sending a low volume of mail (35-60 messages/minute) per IP address, minimizing the email body text and creating sophisticated and realistic email lures.
A new attack tactic has been discovered by Proofpoint researchers â€“ using a high volume of unique URLs. In a single attack this month, 4,994,080 unique URLs were utilised. 10 distinctive links were embedded in the email lure seen below. Once generated and included in the message, the URLs were not reused. This is a new combination – a sophisticated email lure and multiple unique URLs. Each of the 10 unique links per message led to an exploit kit instances. The campaign utilized 503,092 messages- a relatively small campaign by message volume. Other notable campaign statistics include:
- Sender IP addresses: 14,324
- Sender email addresses: 28,008
- Number of compromised web domains: 14
If you wish to learn more about our Spam and Virus Email protection service, powered by Proofpoint Essentials, please contact our Sales Team.