You think you know where your organization's spam is coming from? Better check -- you may find the pattern has shifted in the past few weeks.

Spam -- and the malware it sometimes bears -- have taken some sharp turns since the beginning of June, and if you aren't watching for them, you could end up on the side of the road, security researchers say.

The biggest shift is the volume of PDF-based spam, which has grown even faster than many researchers predicted when the trend was first reported earlier this month. Security vendor MX Logic yesterday reported a 25 percent increase in spam volume as a result of the image-based spam.

"With PDF spam, the images are embedded within attached .pdf documents instead of within the body copy of the message," an MX Logic spokesperson said. "These messages are much larger than traditional text spam, potentially causing business disruptions due to a dramatic spike in bandwidth utilization."

MX Logic also is seeing an increase in spam that uses text within a PDF document instead of images. "MX Logic expects this shift to continue, and believes that this is truly the next evolution of spam," the spokesperson said. "In fact, as image spam volumes continue to decline, MX Logic expects PDF spam to take its place and greatly increase."

Symantec, BorderWare, and Marshal are among the other security vendors that also have reported a marked increase in PDF spam. (See New Image Spam Threat Uses PDF Files, BorderWare Finds New Trend: PDF Image Spam, and Marshal Warns of New Spam Tactics.)

While many researchers are warning about changes in spam's form factor, Sophos Labs says there also are some quiet shifts in its geography.

"The United States continues to relay more spam than any other nation, accounting for 19.6 percent -- a decrease of just 0.2 percent from the previous quarter," Sophos reported yesterday. "However, Europe now has six entries in the dirty dozen, which when combined, account for even more spam-relaying than the U.S."

Despite the strong presence of the U.S. and European nations in the the top 12 ("dirty dozen"), the sheer number of Asian nations relaying smaller amounts of spam meant that Asia proved to be the biggest spam-relaying continent during the second quarter, Sophos says. While Europe -- which topped the chart in the first quarter 2007 -- has reduced its percentage by 6.6 percent and fallen to second place, Asia, North America, South America, and Africa have all seen rises in spam-relaying activity.

Sophos experts predict further leveling of these statistics over the coming months, as spammers start to take advantage of the growing number of inadequately protected computers in places like South America and Africa.

— Tim Wilson, Site Editor, Dark Reading