A report by Postini suggests a 381 percent rise compared to April, while directory harvest (or dictionary) attacks also rose by a third.
"Sober worm traffic in May was staggering, representing a higher percentage of email messages than legitimate emails for a period of four days," said Andrew Lochart, senior director of marketing at Postini. "New viruses and new variants of existing viruses constantly threaten enterprise networks."
According to the U.S. firm the Sober worm accounted for 78 percent of May's viruses.
Antivirus company Sophos' monthly report reveals the most prevalent Sober variant was Sober.N. Through May SC reported the worm, which spreads attached to email promising World Cup tickets, was causing heightened antivirus alert ratings.
"Sober.N stormed to the top of the chart in early May, making it one of the biggest outbreaks so far this year," said Carole Theriault, security consultant at Sophos. "The Sober.Q Trojan, released a few weeks later, searched for computers infected with Sober.Q and attempted to secretly turn them into spamming machines."
Sober.Q spread attached to right-wing Nazi hate mail.