You are here

Home › A Lot of Playing Going On in Fortinet's...

A Lot of Playing Going On in Fortinet's Most-Reported Threats for Apr 2008

Asian Countries the Target of Online Gaming Ploys

SUNNYVALE, Calif. - May 2, 2008 - Fortinet® - the pioneer and leading provider of unified threat management (UTM) solutions - today announced that the top 10 most reported high-risk threats for April 2008 were driven by a campaign launched on April Fools Day and two online gaming Trojans that primarily targeted a number of Asian countries: China/Hong Kong, India, Japan, Korea and Taiwan. With their eyes on Asia, Trojans OnLineGamesEncPK.fam!tr.pws and OnLineGames.SIN jumped 15 and 31 spots, respectively, to land in the sixth and seventh positions on Fortinet's Top 10 list for April. Additionally, the Cutwail variant Mutant.CV made an impressive debut at the No. 2 position and was first observed on April Fools Day as a screen-saver attachment in mass mail.

Fortinet's FortiGuard™ Global Security Research Team compiled this report based on intelligence gathered from FortiGate™ multi-threat security systems in production worldwide.

Additional malware trends observed during this period include the following:

  • OnLineGamesEncPK.fam!tr.pws targeted 80 percent of its attack on Taiwan. The remaining 20 percent were spread among Japan (7.1), the U.S. (1.9), India (1.7), Mexico (1.1) and others.
  • OnLineGames.SIN also focused 80 percent of its efforts on one Asian country, choosing China to receive the brunt of its attack. Japan (7.6), Hong Kong (4.6), Taiwan (2.3), Korea (1.0) and others made up the remainder.
  • In addition to the heavy attack on one country, emails seeded with the two online gaming Trojans also leveraged the traditional Chinese language as a localization tactic.
  • Mutant.CV began its campaign on April Fools Day with concentrated spikes of activity, while the gaming Trojans showed consistent daily volume throughout the month.

"With Asia accounting for more than 50 percent of all online gaming revenue worldwide according to recent reports, it's no surprise that the cyber criminal activity we witnessed this past month were localized attacks to this region," said Derek Manky, security researcher for Fortinet. "Due to the prosperous nature of the thriving online gaming community, it's highly likely we will continue to see these types of attacks in the future."

Following are the Top Ten individual threats and Top Five threat families in April. Top 100 shifts indicate positional changes compared to March's Top 100 ranking, with "new" representing the malware's debut in the Top 100.

Top Ten Individual Threats

Rank Threat Name Threat Type % of Detections Top 100 Shift
1 W32/Netsky!similar Mass mailer 8.6 +1
2 W32/Mutant.CV!tr.dldr Trojan 7.2 new
3 HTML/Iframe_CID!exploit Exploit 6.0 -
4 W32/Pushdo.EV!tr.dldr Trojan 5.6 -3
5 W32/Virut.A Virus 5.6 +4
6 W32/OnLineGamesEncPK.fam!tr.pws Trojan 4.1 +15
7 W32/OnLineGames.SIN!tr.pws Trojan 2.6 +31
8 W32/MyTob.BH.fam@mm Mass mailer 2.2 -3
9 W32/Small.FQS!tr.dldr Trojan 2.0 +7
10 W32/MyTob.FR@mm Mass mailer 1.5 -4

Top Five Families

Rank Malware Family Percentage Top 10 Shift
1 Netsky 13.8 -
2 MyTob 8.5 +1
3 Cutwail 7.2 new
4 Virut 6.0 -
5 Pushdo 5.9 -3

To read the full April report, please visit: http://www.fortiguardcenter.com/reports/roundup_apr_2008.html. For ongoing threat research, bookmark the FortiGuard Center (http://www.fortiguardcenter.com/) or add it to your RSS feed by going to http://www.fortinet.com/FortiGuardCenter/rss/index.html. To learn more about FortiGuard Subscription Services, visit http://www.fortinet.com/products/fortiguard.html.

About Fortinet (www.fortinet.com)

Fortinet is the pioneer and leading provider of ASIC-accelerated unified threat management, or UTM, security systems, which are used by enterprises and service providers to increase their security while reducing total operating costs. Fortinet solutions were built from the ground up to integrate multiple levels of security protection--including firewall, antivirus, intrusion prevention, VPN, spyware prevention and anti-spam -- designed to help customers protect against network and content level threats. Leveraging a custom ASIC and unified interface, Fortinet solutions offer advanced security functionality that scales from remote office to chassis-based solutions with integrated management and reporting. Fortinet solutions have won multiple awards around the world and are the only security products that are certified in six programs by ICSA Labs: (Firewall, Antivirus, IPSec, SSL, Network IPS, and Anti-Spyware). Fortinet is privately held and based in Sunnyvale, California.

Copyright © 2008 Fortinet, Inc. All rights reserved. Fortinet is a registered trademark of Fortinet, Inc. FortiGate, FortiOS, FortiAnalyzer, FortiASIC, FortiCare, FortiManager, FortiWiFi, FortiGuard, FortiClient, FortiReporter and other names are trademarks of Fortinet, Inc. in the United States and/or other countries. All other trademarks referred to herein are the property of their respective owners.

How to Buy

Purchase Fortinet Products


Only a few vendors can provide security appliances with such high firewall performance. We were very happy with the high level of security, service reliability and cost-effectiveness provided by Fortinet's solutions, so it was a natural progression to look at Fortinet's recently introduced enterprise security appliance. The tests conducted on the FortiGate-3810A proved that Fortinet's new system addressed our high network bandwidth and security performance requirements.

Sylvain Meunier
Network Architect
Onera