Coronavirus-themed security attacks on the increase

1 March 2020 Cyber Security

When there is a crisis, there are those that will try and take advantage. Unfortunately, cybercriminals aren't guided by the same moral compass as the rest of humanity. In fact, they are using the current COVID-19 pandemic to try and break through defences by using scare tactics and a variety of malicious campaigns including email spam, malware, ransomware, malicious domains, and sending seemingly helpful emails to spread infected files.

Locally, South Africa’s president, Cyril Ramaphosa has urged the nation to remain in isolation so that we can contain the virus in an attempt to minimise the widespread devastation the world is bearing testament to.

All industries are using remote working as a means to reinforce social distancing, but that means users aren't always behind their enterprise firewall, which is a problem. While we are no medical experts, we are security experts, and it is critical at this time that consumers and remote workers become even more cautious.

Spam

At a time like this, humans are starved for information and will turn to our email to get it. But be careful, the coronavirus disease (COVID-19) is being used as bait in email spam attacks on targets around the globe. As the number of those afflicted continue to surge by thousands, campaigns that use the disease as a lure likewise increase.

As of this week, Trend Micro Researchers uncovered 2 814 instances of Coronavirus spam in South Africa alone. The data has been collected from almost 7 000 unique samples out of 41 000 total Corona Phishing Spam samples reported from Smart Protection Network (SPN) enabled in Trend Micro Messaging products.

In addition, Trend Micro researchers acquired email samples sent to and received from all over the globe, including countries such as the U.S., Japan, Russia, and China. These emails are designed to look like they originated from an official health organisation and have updates, recommendations, and safety tips. But unfortunately, they also contain malicious attachments.

One particular sample received by our team had the subject 'Corona Virus Latest Updates' and claimed to come from the Ministry of Health in the U.S. It was in fact spoofed, contained malware, and was of no use at all. This is just one example. Others include delivery notices asking you to update details, access to a proposed vaccine, and emails asking you to update medical information.

Malware files

Then there are more blatant attacks, our Trend Micro researchers were also able to detect malware with 'corona virus' in their filename. Including:

• CORONA VIRUS AFFECTED CREW AND VESSEL.xlsm

• CoronaVirusSafetyMeasures_pdf.exe

• LIST OF CORONA VIRUS VICTIM.exe

• POEA HEALTH ADVISORY re-2020 Novel Corona Virus.pdf.exe

Malware files are also being seeded in fake news sites that purport to provide updates, dashboards and maps on the spread of the virus. One look at the sudden number of websites that now have the name 'corona' in them, and you will see that there is a problem.

Business email compromise

Our researchers were also alerted of a Business Email Compromise (BEC) attack mentioning coronavirus, which was reported by the Agari Cyber Intelligence Division (ACID). Spearheaded by a well-known BEC group called 'Ancient Tortoise', the threat actors targeted accounts receivables by getting them to forward old account reports.

The information was used to send targeted emails under the auspices of legitimate companies to try and collect data. Their hook? These cybercriminals were working under the guise that banking and payment methods needed to be updated, in light of COVID-19.

Ransomware

Another example includes a new ransomware variant called CoronaVirus, spread through a site that proposed to assist with cleaning and optimising your system. The Malware HunterTeam exposed this instance. Those who fell prey to this event unwittingly downloaded the WSGSetup.exe file from the fake site. The executable file inserted a malware downloader for The CoronaVirus ransomware as well as the password-stealing trojan, Kpot.

Secure your defences

Unfortunately, as much as we need to get people comfortable to the concept of working from home, and we have the tools to do so, we also need to arm them with the facts. We need to educate employees that these threats are real, and they may fall prey to disingenuous actors who are feeding off of the untenable situation we find ourselves in as a result of this pandemic.

At Trend Micro, we are encouraging our partners and customers to play open cards with their employees, present them with the facts, and update them regularly of the current scams doing the rounds. Most importantly, ensure that the endpoints that are now accessing your systems remotely remain secure.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Next-generation security operations centre
Issue 4 2020, AVeS Cyber Security , Cyber Security
Pay-as-you-use cybersecurity from AveS allows all businesses access to world-class expertise.

Read more...
Strengthen your passwords for world password day
Issue 4 2020 , Cyber Security
May 7 is World Password Day and KnowBe4 is providing tip sheets, videos and tools to help people strengthen their passwords.

Read more...
Tips on secure remote working
Issue 3 2020 , IT infrastructure, Cyber Security
NordVPN advises how to stay secure while working from home during the coronavirus outbreak.

Read more...
The Trojan that’s nearly impossible to remove
Issue 3 2020, Kaspersky , Cyber Security
xHelper – the Trojan that’s nearly impossible to remove – continues to infect thousands of devices. How can you stay safe?

Read more...
Have your security on lockdown over the lockdown
Issue 3 2020, Vox Telecom , Cyber Security
It’s a given that people working from home have fewer security defences on their home networks than they would have in the office.

Read more...
Free enterprise-grade security to healthcare organisations
Issue 3 2020 , Cyber Security
Bitdefender offers free enterprise-grade security to all healthcare organisations for up to 12 months.

Read more...
Someone is out to steal your cookies
Issue 3 2020, Kaspersky , Cyber Security
Kaspersky experts have discovered two new Android malware modifications that, when combined, can allow the thieves to discreetly gain control of the victim’s account.

Read more...
The political and economic intentions of cybercriminals
Issue 3 2020 , Cyber Security
FortiGuard Labs’ Threat Landscape Report reveals a new perspective on global trade and the allure of election disruption.

Read more...
FortiGate 1800F next-generation firewall
Issue 3 2020 , Cyber Security
FortiGate 1800F next-generation firewall enables today’s largest enterprises to achieve internal segmentation as well as scale, performance, detection, and enforcement capabilities.

Read more...
Simple and secure for small businesses
Issue 3 2020 , Cyber Security
New cloud-driven solutions from Cisco make buying, installation and maintenance easy with the Cisco ‘Designed for Business’ portfolio built for simplicity and security.

Read more...