Microsoft released their latest cybersecurity report on Wednesday - the report shows that there has been a marked decline in the overall percentage of severe vulnerabilities that were exploited in Microsoft products between 2010 and 2013. This is good, but they also warn that the criminals are keeping up and finding alternate ways to exploit users by using more deceptive practices.

According to the Microsoft Security Blog, the data compiled shows that in the second half of 2013 there was a noticeable increase in cybercriminal activity where attackers used deceptive practices. The continued increase in deceptive tactics is striking; in the last quarter of 2013, the number of computers impacted as a result of deceptive tactics more than tripled. The security mitigations included in newer Microsoft products have raised the technical bar for would-be attackers, which may be one of the factors driving an increase in the use of deceptive tactics.



Foremost among the tactics many attackers are using is “deceptive downloads.” In more than 95% of the 110 countries/regions we studied, deceptive downloads were a top threat. Cybercriminals are secretly bundling malicious items with legitimate content such as software, games or music. Taking advantage of people’s desire to get a good deal, cybercriminals are bundling malware with free programs and free software packages that can be downloaded online. For example, a typical scenario is someone that has a file they downloaded from a website that they can’t open because they don’t appear to have the right software installed to open it. As a result, they search online and come across a free software download that might help them open the file. The free download also comes with other add-ons. In addition to what the person thought they were getting, the download also installs malware. The malware may be installed immediately or at a later date as it assesses the victim’s computer’s profile. It could be months or even years before the victim notices the infection, as often these malicious items operate behind the scenes with the only visible effect being slower performance on the system that was infected.

But that wasn’t the only tactic they used. A second notable deceptive tactic in use was Ransomware. The concept is simple: cybercriminals digitally hijack a person’s machine and hold it for ransom; refusing to return control of it or their files until the victim pays a fee. In many cases, control of the computer or files is never returned to the victim, causing them to lose valuable data, pictures, movies, music, etc. Between the first and second halves of 2013, the top ransomware threat encountered globally, increased by 45 percent.

Another interesting exploit targets small business owners; it comes via email disguised as an attached invoice for payment. According to Malwarebytes, just a couple of days ago they spotted a new wave of spam emails spewing malicious PDF files. The decoy, which purports to be an invoice, is directly attached to an email targeting small businesses - The infection is only a double click away. The files that are dropped download many additional pieces of malware: the infamous ZeuS banking Trojan, CryptoLocker as well as other threats.



Microsoft notes, that while deceptive tactics have increased in prevalence, there are actions people can take to help protect themselves and their organizations. Using newer software whenever possible and keeping it up to date, only downloading software from trusted sources, avoid opening email and instant messages from untrusted or unknown senders, running antivirus software and keeping it up to date, and backing up valuable data and files, make it much harder for attackers who use deceptive practices to be successful.