Half of all phishes from Romanian cyber gang

By Rene Millman

Posted on 18 Dec 2006 at 11:56

'Rock Phish' outfit are behind '50 per cent or more of current phishing attacks today,' says VeriSign.

Over half of phishing emails in the world are thought to come from just one criminal gang, according to a security expert.

Ken Dunham, director of the VeriSign's security research unit iDefense Rapid Response Team, said that the gang, called 'Rock Phish', is 'likely responsible for 50 per cent or more of current phishing attacks today.'

He said that the gang is working out of Romania or a nearby country. 'This group has been in operation since 2004 and is responsible for innovation in both spam and phishing attacks to date, such as pioneering image-spam,' said Dunham. 'The group is named after URL characteristics, where strings such as "rock" or "r" may appear in a phishing URL.'

Since then the group has evolved its strategy and dropped 'rock' from phishing URLs in order to avoid detection from filters. Nowadays, most new browsers include some rudimentary anti-phishing technology, but the group has begun to create unique URLs in its phishing attacks in order to circumvent these filters. Dunham said that the gang has 'successfully automated a highly sophisticated fraud ring involving spam and phishing for criminal gain.'

The gang avoids the more popalur sites to attack, such as eBay and PayPal, instead targeting US and European banks and other financial institutions. 'Estimated phishing losses from Rock Phish alone are in the millions annually. The group has reportedly attacked 44 different brands to date in at least nine different countries,' said Dunham.

Jamz Yaneza, senior threat research analyst at anti-virus company Trend Micro said that computer crime has evolved into organised crime and 'is no longer the game of individual attackers.'

'With money as their main driver, our research has tracked how attacks have moved from being fast and large scale to being cleverly crafted to attack very specific groups under the radar,' he said. 'The unseen web threat is maturing, and users should be ever-more careful about what they download and install, as blended threats are ever-more cunning in their attempt to steal corporate and personal data or money.'