Micro-managed attacks that consist of one e-mail targeting one person are up more than 10 times over last year's levels, a message security company said Tuesday.
These targeted attacks aim a very low number of spam messages - more often than not just one - at individuals working at companies or government agencies with data that criminals prize.
Like spam that is blasted in massive quantities, these messages come with a malicious payload that tries to compromise the recipient's PC, usually by bundling multiple exploits against zero-day vulnerabilities or bugs that user organisations have not yet patched.
In a report issued on 18 April, MessageLabs said it intercepted 716 messages from 249 targeted attacks last month; those attacks were aimed at 263 domains representing 216 customers.
Alex Shipp, a MessageLabs research engineer, said "Two years ago it was two attacks a week, last year (it was) two a day."
Most of the attacks rely on malformed Microsoft Office documents, in particular Word and PowerPoint files, said Shipp. "They're not just using one exploit, but several" in a single malicious file, he added. Together, Office documents made up 84 percent of March's detected one-off attacks.
Those exploits are so successful, said Shipp, that one Chinese hacker gang has relied on the same two attack files since November 2006, and used the pair more than 150 times in the last five months.
Almost a quarter of March's victims identified by MessageLabs were targeted on public sector organsiations. "All of these are data-stealing attacks," said Shipp. "They want to get information, and they all eventually use some kind of PC remote control malware to exploit the organisation." Shipp declined to go into more detail, citing customer confidentiality.
Microsoft's Office suite was patched numerous times in 2006, and more fixes were released in January and February of this year for Excel and Word, respectively.
PowerPoint, however, hasn't been patched since October 2006. Several PowerPoint bugs have yet to be fixed, including one acknowledged by the Microsoft Security Response Centre (MSRC) last year. Because the MSRC determined that the flaw wasn't remote exploitable, however, it decided not to release a patch.
Shipp did not say which PowerPoint vulnerabilities attackers might have exploited in March, but the MessageLabs report offered some detail. "It may be a PowerPoint record length exploit, but there are several other areas of interest in the files which may be the trigger," the report said.
While the attackers seem to be concentrated in China, their victims are scattered across the globe, said Shipp.
Find your next job with computerworld UK jobs