COVID-19 Exploited by Malicious Cyber Actors

ronjor · Apr 8, 2020

Original release date: April 08, 2020

This is a joint alert from the United States Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the United Kingdom’s National Cyber Security Centre (NCSC).
This alert provides information on exploitation by cybercriminal and advanced persistent threat (APT) groups of the current coronavirus disease 2019 (COVID-19) global pandemic. It includes a non-exhaustive list of indicators of compromise (IOCs) for detection as well as mitigation advice.
Both CISA and NCSC are seeing a growing use of COVID-19-related themes by malicious cyber actors. At the same time, the surge in teleworking has increased the use of potentially vulnerable services, such as virtual private networks (VPNs), amplifying the threat to individuals and organizations.
APT groups and cybercriminals are targeting individuals, small and medium enterprises, and large organizations with COVID-19-related scams and phishing emails. This alert provides an overview of COVID-19-related malicious cyber activity and offers practical advice that individuals and organizations can follow to reduce the risk of being impacted. The IOCs provided within the accompanying .csv and .stix files of this alert are based on analysis from CISA, NCSC, and industry.
Click to expand...

ronjor · Apr 14, 2020

Protecting healthcare and human rights organizations from cyberattacks (Microsoft)

14 April 2020
Through today’s announcement, we’re making AccountGuard available to healthcare providers including hospitals, care facilities, clinics, labs and clinicians providing front line services as well as pharmaceutical, life sciences and medical devices companies that are researching, developing and manufacturing COVID-19-related treatments. Our notifications will help these organizations defend against nation-state attacks, and our AccountGuard advice and training support will help them harden their defenses against all forms of cyberattacks. AccountGuard for Healthcare will be available until the COVID-19 pandemic subsides.
Click to expand...

guest · Jun 8, 2020

Hackers target senior executives at German company procuring PPE
June 8, 2020
https://www.cyberscoop.com/germany-ppe-coronavirus-hackers-ibm/

On March 30, as the novel coronavirus swept through Germany, the country’s government tasked nine multinational companies, including pharmaceutical giant Bayer and automaker Volkswagen, with procuring personal protective equipment to make up for a lack of gear.
The same day, unidentified hackers began an intensive phishing campaign to infiltrate at least one of those nine firms, according to research published Monday by IBM.

The phishing attempts against the unnamed German company, which are ongoing, have extended to more than 100 senior management and procurement executives at the company and its suppliers in multiple sectors, according to IBM. It is unclear if the hacking has been successful, or who is responsible (IBM researchers weren’t sure).

“They were targeting high-ranking executives…in companies that, together, form an essential supply chain to respond to the coronavirus crisis.”
The phishing links were designed to direct executives to fake Microsoft login pages to steal their credentials and send them to accounts hosted on Yandex, a popular Russian email service.
Click to expand...

IBM X-Force: German Task Force for COVID-19 Medical Equipment Targeted in Ongoing Phishing Campaign

Given the worldwide spread of COVID-19 and fears of a pending second wave of infection, it is highly likely criminal and state-sponsored actors alike will seek to exploit global procurement and supply chains with the intention of either profiting from the crisis or supporting the acquisition activities of their host nation.
Click to expand...

guest · Jul 7, 2020

Microsoft takes legal action against COVID-19-related cybercrime
July 7, 2020
https://blogs.microsoft.com/on-the-issues/2020/07/07/digital-crimes-unit-covid-19-cybercrime/

Today, the U.S. District Court for the Eastern District of Virginia unsealed documents detailing Microsoft’s work to disrupt cybercriminals that were taking advantage of the COVID-19 pandemic in an attempt to defraud customers in 62 countries around the world. Our civil case has resulted in a court order allowing Microsoft to seize control of key domains in the criminals’ infrastructure so that it can no longer be used to execute cyberattacks.

Microsoft takes many measures to monitor and block malicious web apps based on telemetry indicating atypical behavior and has continued to enhance our protections based on this activity. In cases where criminals suddenly and massively scale their activity and move quickly to adapt their techniques to evade Microsoft’s built-in defensive mechanisms, additional measures such as the legal action filed in this case are necessary.
Click to expand...

This unique civil case against COVID-19-themed BEC attacks has allowed us to proactively disable key domains that are part of the criminals’ malicious infrastructure, which is a critical step in protecting our customers.
Click to expand...

Log in or Sign up

COVID-19 Exploited by Malicious Cyber Actors

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

Log in or Sign up

COVID-19 Exploited by Malicious Cyber Actors

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

Useful Searches