Profiting From Panic—Cybercrime Under COVID-19

The great American businessman and philanthropist, John Rockefeller once said “I always tried to turn every disaster into an opportunity.” I doubt he ever envisaged that cybercriminals will heed his words to profit from panic.

Leading cyber intelligence company, Recorded Future, confirmed the registration of thousands of fake coronavirus-related websites. Make no mistake, these domains are being used to phish for information or infect computer networks with malware. Preying on current fears due to the global outbreak of COVID-19, criminals are banking on unsuspecting employees clicking on coronavirus-related links without thinking. The risk is further exacerbated by the hundreds of thousands of employees worldwide now working from home.

In its weekly summary, Verizon's Threat Research Advisory Center outlined a number of security-related developments including patches for over 116 Microsoft products and a number of attacks involving multiple advanced persistent threat (APT) actors.

What are cybercriminals doing?

Among the multiple organizations issuing warnings, the Federal Trade Commission issued a memo alerting consumers about the increase in spoofed emails, text messages, and phone calls that claim to be from the Centers for Disease Control (CDC). These websites offer a “cure” to the virus with remedies, vaccines and testing kits.

According to the UN health agency, criminals have are also attempting to pose as WHO representatives in an effort to carry out a variety of scams, from account takeovers to phone donation requests and the spread of malware.

The influential security blog, Krebs on Security, recently reported that an interactive dashboard of Coronavirus infections and deaths produced by Johns Hopkins University is being used in malicious web sites to spread malware.

How are the bad guys working?

Even before COVID-19 crept up on us, phishing was a popular—and effective—technique for attackers. Phishing is an attempt, usually to steal your credentials and obtain sensitive information. These can include an email message containing a link to a fake website that looks like a log-in page from a cloud-based email provider. In 2019, nearly a third of all breaches involved a phishing attack, making it the top threat action used in successful breaches, according to Verizon's 2019 Data Breach Investigations Report (DBIR). 

When the bad guys come looking for you, they’re aware that your company has security protocols in place, so threat actors are usually forced to take at least a few actions before they get what they want. The DBIR goes on to note that 28% of the more than 2,000 breaches involved malware infections—usually delivered by email—and 29% involved the use of stolen credentials, both of which are frequently accomplished through phishing attacks.

“Mobile OS and apps also restrict the availability of information often necessary for verifying whether an email or webpage is fraudulent. For instance, many mobile browsers limit users’ ability to assess the quality of a website’s SSL certificate. Likewise, many mobile email apps also limit what aspects of the email header are visible and whether the email-source information is even accessible," according to 2019 Verizon Data Breach Investigative Report.

What can you do?

To avoid any risk, if you spot emails coming from coronavirus-related domains, do not click on any attachments, simply delete the emails. Be wary of websites soliciting for donations, offering medical advice and supplies and advice on the financial markets. In short, don’t take the bait by clicking on links from sources you don’t know.

If the email message is conveying an important or urgent matter from an organization you know—e.g. your bank or hospital—contact the sender through alternate and official channels. Of course, it goes without saying that you need to keep your system security up-to-date and encrypt/password protect sensitive information. If you’re working from home, please ensure that your VPN contains two-factor authentication to secure your network.

Ashish Thapar, managing principal and regional head—APJ at Verizon, authored this article. The views and opinions expressed in this article are those of the author and do not necessarily reflect those of CDOTrends. Photo credit: iStockphoto/Melpomenem