Bredolab is the most common email-borne malware

Aug 4, 2010 15:07 GMT  ·  By

According to a mid-year report (PDF) from antivirus vendor Sophos, the United States remains the dominant country when it comes to hosting infected Web pages and relaying spam. Meanwhile, the Bredolab trojan is by far the top threat distributed via malicious emails.

Data gathered by Sophos during the first six months of this year suggests that a whooping 42.29% of infected websites are hosted in the United States. This is not all that surprising since many of the world's Web hosting companies have their servers in US. However, the most interesting aspect is the the gap between the first and second place, currently occupied by China with 10.75%, keeps widening.

China has not registered any significant improvement to its overall score during the first half of 2010, which dropped only by a mere 0.5% from 11.2% in 2009. Russia, on the other hand cut its rate in half, from 12.8% last year to 6.13% now. Unfortunately, this is still enough to place it in the third spot.

The rest of the top ten is completed by Germany (4.08%), France (3.92%), United Kingdom (2.41%), Italy (2.09%), Netherlands (1.76%), Turkey (1.74%) and Iran (1.53%). It's worth noting that half of the countries are from Europe.

As far as spam origin is concerned the situation is a bit more tied. United States leads the top with 13.81% and is followed by India with 7.51% and Brazil with 6.27%. The list is filled in order by South Korea (4.585), United Kingdom (3.72%), Germany (3.54%), France (3.52%), Italy (3.27%), Vietnam (3.06%), Russia (2.99%), Poland (2.44%) and Romania (2.41%).

According to Sophos, email-borne malware remains a significant threat and Bredolab is leading this landscape by far. The trojan, which usually comes attached to fake DHL, UPS or FedEx emails, accounts for 45.97% of all malware samples distributed in this way. Fake antivirus applications (scareware) is in second place with 11.33%, while malicious JavaScript redirects follow with a 10.67% rate.

You can follow the editor on Twitter @lconstantin