View source for Targeted threat

'''Targeted threats''' are a class of [[Malware|malware]] destined for one specific organization or industry.  A type of crimeware, these [[Engineering:Threat (computer)|threats]] are of particular concern because they are designed to capture sensitive information.  Targeted attacks may include threats delivered via SMTP e-mail, port attacks, zero day attack [[Vulnerability (computing)|vulnerability]] exploits or [[Phishing|phishing]] messages.  Government organisations are the most targeted sector.<ref>{{Cite web|url=http://www.symantec.com/connect/blogs/targeted-attacks-now-using-bredolab-malware|title=Email Security.cloud - Symantec Enterprise}}</ref>  Financial industries are the second most targeted sector, most likely because cybercriminals desire to profit from the confidential, sensitive information the financial industry IT infrastructure houses.<ref>Symantec Corp., Symantec Internet Security Threat Report, Vol X, Sep. 2006, p. 9.</ref> Similarly, online brokerage accounts have also been targeted by such attacks.<ref>Security and Exchange Commission. "Online Brokerage Accounts: What You Can Do to Safeguard Your Money and Your Personal Information." https://www.sec.gov/investor/pubs/onlinebrokerage.htm</ref>
==Impact==
The impact of targeted attacks can be far-reaching.  In addition to regulatory sanctions imposed by HIPAA, Sarbanes-Oxley, the [[Finance:Gramm–Leach–Bliley Act|Gramm-Leach-Bliley]] Act and other laws, they can lead to the loss of revenue, focus and corporate momentum.  They not only expose sensitive customer data, but damage corporate reputations and incur potential lawsuits.<ref>Williams, Amrit T., Hallawell, Arabella, et al., "Hype Cycle for Cyberthreats, 2006", Gartner, Inc., Sept. 13, 2006, p. 17</ref>

==Detection and prevention==
In contrast to a widespread spam attack, which are widely noticed, because targeted attacks are only sent to a limited number of organizations, these crimeware threats tend to not be reported and thus elude malware scanners.<ref>Shipp, Alex quoted in Gibbs, Wayt. "The Rise of Crimeware.", February 23, 2006. {{cite web |url=http://blog.sciam.com/index.php?title=the_rise_of_crimeware |title=The Rise of CrimewareBLOG: SciAm Observations: A blog from the editors of Scientific American |accessdate=2006-11-28 |url-status=dead |archiveurl=https://web.archive.org/web/20061206192113/http://blog.sciam.com/index.php?title=the_rise_of_crimeware |archivedate=2006-12-06 }}</ref>

* '''Heuristics'''
* Multiple-layered '''pattern scanning'''
* '''Traffic-origin scanning.'''  Targets known bad locations or traffic anomalies.
* '''Behavior observation.'''  Including desktop emulator solutions and virtual machine behavior analysis.

==Examples==
* In one instance, [[Trojan horse (computing)|Trojan horses]] were used as a targeted threat so that Israeli companies could conduct corporate espionage on each other.<ref>Williams, Dan. "Israel holds couple in corporate espionage case." "http://www.computerworld.com/securitytopics/security/virus/story/0,10801,108225,00.html?from=story_kc, Jan. 31, 2006</ref>
* The Hotword Trojan, the Ginwui and the PPDropper Trojans are additional examples of Trojans used for corporate espionage.<ref>Symantec Corp., Symantec Internet Security Threat Report, Vol X, Sep. 2006, p. 4.</ref>
* Targeted destination attacks use harvested IP addresses to send messages directly to recipients without an MX record lookup.  It aims for specific sites and users by defeating hosted protection services and internal gateways to deliver e-mail with malicious payloads.<ref>Avinti, Inc. "Targeted Destination Attacks." Sep. 2005. {{cite web |url=http://www.avinti.com/download/labs/targeted_destination.pdf |title=Archived copy |accessdate=2006-11-28 |url-status=dead |archiveurl=https://web.archive.org/web/20120215102852/http://www.avinti.com/download/labs/targeted_destination.pdf |archivedate=2012-02-15 }}</ref>

==External links==
*[http://www.daemon.be/maarten/targetedattacks.html An analysis of Targeted Attacks]

==Notes==
<references/>

[[Category:Types of malware]]

ja:標的型攻撃

{{Sourceattribution|Targeted threat}}