Online Threats and Malware Trends in India 2012-2014. Summary: - The top malware infection in India is still Botnet related. - Hackers own your PC’s and use them for spamming, DDOS or other malicious activity to make money. - Banking related malware has been consistently topping the chart in India. - Ramnit malware steals bank user names and passwords. - The malware spreads through USB removable drives. - PC’s in India are moving away from Windows XP. - We have also observed the decline in Downadup/Conficker infection over the past 3 years in India.

1. The State of the Net
in India
From 2012 to 2014…

2. What have we
learned in
2014?
© F-Secure Confidential2

3. Executive Summary
 The top malware infection in India is still Botnet related
 Hackers own your PC’s and use them for spamming, DDOS or other malicious
activity to make $$
 Banking related malware has been consistently topping the chart in India
 Ramnit malware steals bank user names and passwords
 Spreads through – USB removable drives
 PC’s in India are moving away from Windows XP
 We have also observed the decline in Downadup/Conficker infection over the past
3 years in India
© F-Secure Confidential3

4. © F-Secure Confidential4
0
500
1000
1500
2000
2500
1/1/2014
1/6/2014
1/11/2014
1/16/2014
1/21/2014
1/26/2014
1/31/2014
2/5/2014
2/10/2014
2/15/2014
2/20/2014
2/25/2014
3/2/2014
3/7/2014
3/12/2014
3/17/2014
3/22/2014
3/27/2014
4/1/2014
4/6/2014
4/11/2014
4/16/2014
4/21/2014
4/26/2014
5/1/2014
5/6/2014
5/11/2014
5/16/2014
5/21/2014
5/26/2014
5/31/2014
6/5/2014
6/10/2014
6/15/2014
6/20/2014
6/25/2014
6/30/2014
7/5/2014
7/10/2014
7/15/2014
7/20/2014
7/25/2014
7/30/2014
8/4/2014
8/9/2014
8/14/2014
8/19/2014
8/24/2014
8/29/2014
9/3/2014
9/8/2014
9/13/2014
9/18/2014
9/23/2014
9/28/2014
10/3/2014
10/8/2014
10/13/2014
10/18/2014
10/23/2014
10/28/2014
11/2/2014
11/7/2014
11/12/2014
11/17/2014
11/22/2014
11/27/2014
12/2/2014
12/7/2014
12/12/2014
12/17/2014
12/22/2014
12/27/2014
(blank)
Timeline 2014 : total count of detections in India

5. © F-Secure Confidential5

6. Malware
Trends in India
2012-2014
© F-Secure Confidential6

7. © F-Secure Confidential7
2012 2013 2014
%

8. Cities
breakdown in
India
© F-Secure Confidential8

9. © F-Secure Confidential9
Delhi
20%
Hyderabad
9%
Chennai
7%
Chandigarh
9%
All other cities (536)
55%
Top 5 Cities in India, by % of total detections (2014)

10. © F-Secure Confidential10 0 0.1 0.2 0.3 0.4 0.5 0.6
Stealth_file
Win32.Virtob.Gen
Trojan.LNK.Gen
Ramnit
Sality
Trojan-Spy:W32/Zbot.AVTF
Ramnit
Trojan.Script
Trojan.LNK.Gen
Sality
JS:Exploit.BlackHole.QY
Trojan.LNK.Gen
Ramnit
Trojan.Script
Sality
Trojan.LNK.Gen
Win32.Virtob.Gen
Trojan.Script
Ramnit
Sality
Win32.Virtob.Gen
Ramnit
Trojan.LNK.Gen
Trojan.Script
Sality
ChandigarhChennaiDelhiHyderabadNewDelhi
ChandigarhChennaiDelhiHyderabadNewDelhi
Top 5 Families in Top 5 Cities, by % of total detections per city

11. Highlights
 Cities of interest topping the chart
 Delhi (20%)
 Hyderabad (9%)
 Chandigarh (9%)
 Chennai (7%)
© F-Secure Confidential11

12. The Mobile
Threat
Landscape
© F-Secure Confidential12

13. © F-Secure Confidential13

14. Mainmotivation for hacking
your mobiledevicesinIndia:
Android/SMSSend & Android/FakeInst
 Premium rate SMS is still the No.1 reason behind a high
number of SMS-related malware in the Android
platform in India
 In line with what the CERT-In (Computer Emergency
Response Team of India) found in December of 2014
© F-Secure Confidential14

15. Android/SMSreg
The application also collects the following information:
 API key
 Application ID
 Carrier
 Device manufacturer
 Device model
 GPS location
 International Mobile Equipment Identity(IMEI) number
 Network operator
 Package name
 SDK version
© F-Secure Confidential15

16. Cities in India
breakdown in
mobile
infection
© F-Secure Confidential16

17. © F-Secure Confidential17

18. © F-Secure Confidential18 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%
Hack-tool:Android/Kiser
Riskware:Android/PremiumSMS
Trojan:Android/FakeInst
Monitoring-tool:Android/Sheridroid
Riskware:Android/Smsreg
Monitoring-tool:Android/Sheridroid
Trojan:Android/Iconosys
Trojan:Android/FakeInst
Hack-tool:Android/Kiser
Riskware:Android/Smsreg
Spyware:Android/Counterclank
Trojan:Android/GinMaster
Trojan:Android/Qdplugin
Riskware:Android/Minimob
Trojan:Android/Smssend
Trojan:Android/GinMaster
Riskware:Android/Minimob
Riskware:Android/Smsreg
Spyware:Android/Counterclank
Trojan:Android/Smssend
Riskware:Android/Minimob
Trojan:Android/Boqx
Spyware:Android/Counterclank
Riskware:Android/Smsreg
Trojan:Android/Smssend
GurgaonChennaiChandraDelhiMumbai Top 5 Families in Top 5 Cities, by % of total detections per city

19. Public Wi-Fi
Demo
© F-Secure Confidential19