Coronavirus-themed security attacks on the increase

1 March 2020 Information Security

When there is a crisis, there are those that will try and take advantage. Unfortunately, cybercriminals aren't guided by the same moral compass as the rest of humanity. In fact, they are using the current COVID-19 pandemic to try and break through defences by using scare tactics and a variety of malicious campaigns including email spam, malware, ransomware, malicious domains, and sending seemingly helpful emails to spread infected files.

Locally, South Africa’s president, Cyril Ramaphosa has urged the nation to remain in isolation so that we can contain the virus in an attempt to minimise the widespread devastation the world is bearing testament to.

All industries are using remote working as a means to reinforce social distancing, but that means users aren't always behind their enterprise firewall, which is a problem. While we are no medical experts, we are security experts, and it is critical at this time that consumers and remote workers become even more cautious.

Spam

At a time like this, humans are starved for information and will turn to our email to get it. But be careful, the coronavirus disease (COVID-19) is being used as bait in email spam attacks on targets around the globe. As the number of those afflicted continue to surge by thousands, campaigns that use the disease as a lure likewise increase.

As of this week, Trend Micro Researchers uncovered 2 814 instances of Coronavirus spam in South Africa alone. The data has been collected from almost 7 000 unique samples out of 41 000 total Corona Phishing Spam samples reported from Smart Protection Network (SPN) enabled in Trend Micro Messaging products.

In addition, Trend Micro researchers acquired email samples sent to and received from all over the globe, including countries such as the U.S., Japan, Russia, and China. These emails are designed to look like they originated from an official health organisation and have updates, recommendations, and safety tips. But unfortunately, they also contain malicious attachments.

One particular sample received by our team had the subject 'Corona Virus Latest Updates' and claimed to come from the Ministry of Health in the U.S. It was in fact spoofed, contained malware, and was of no use at all. This is just one example. Others include delivery notices asking you to update details, access to a proposed vaccine, and emails asking you to update medical information.

Malware files

Then there are more blatant attacks, our Trend Micro researchers were also able to detect malware with 'corona virus' in their filename. Including:

• CORONA VIRUS AFFECTED CREW AND VESSEL.xlsm

• CoronaVirusSafetyMeasures_pdf.exe

• LIST OF CORONA VIRUS VICTIM.exe

• POEA HEALTH ADVISORY re-2020 Novel Corona Virus.pdf.exe

Malware files are also being seeded in fake news sites that purport to provide updates, dashboards and maps on the spread of the virus. One look at the sudden number of websites that now have the name 'corona' in them, and you will see that there is a problem.

Business email compromise

Our researchers were also alerted of a Business Email Compromise (BEC) attack mentioning coronavirus, which was reported by the Agari Cyber Intelligence Division (ACID). Spearheaded by a well-known BEC group called 'Ancient Tortoise', the threat actors targeted accounts receivables by getting them to forward old account reports.

The information was used to send targeted emails under the auspices of legitimate companies to try and collect data. Their hook? These cybercriminals were working under the guise that banking and payment methods needed to be updated, in light of COVID-19.

Ransomware

Another example includes a new ransomware variant called CoronaVirus, spread through a site that proposed to assist with cleaning and optimising your system. The Malware HunterTeam exposed this instance. Those who fell prey to this event unwittingly downloaded the WSGSetup.exe file from the fake site. The executable file inserted a malware downloader for The CoronaVirus ransomware as well as the password-stealing trojan, Kpot.

Secure your defences

Unfortunately, as much as we need to get people comfortable to the concept of working from home, and we have the tools to do so, we also need to arm them with the facts. We need to educate employees that these threats are real, and they may fall prey to disingenuous actors who are feeding off of the untenable situation we find ourselves in as a result of this pandemic.

At Trend Micro, we are encouraging our partners and customers to play open cards with their employees, present them with the facts, and update them regularly of the current scams doing the rounds. Most importantly, ensure that the endpoints that are now accessing your systems remotely remain secure.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Managed security solutions for organisations of all sizes
Information Security News & Events
Cyber attackers have become significantly more sophisticated and determined, targeting businesses of all sizes. PwC’s Global Digital Trust Insights Survey 2025 Africa and South Africa highlights the urgent need for organisations to implement robust cyber risk mitigation strategies.

Read more...
Data resilience at VeeamON
Technews Publishing SMART Security Solutions Infrastructure Information Security
SMART Security Solutions attended the VeeamON Tour in Johannesburg in August to learn more about data resilience and Veeam’s initiatives to enhance data protection, both on-site and in the cloud.

Read more...
Troye exposes the Entra ID backup blind spot
Information Security Infrastructure
If you trust Microsoft to protect your identity, think again. Many organisations naively believe that Microsoft’s shared responsibility model covers Microsoft Entra?ID – formerly Azure AD – but it does not.

Read more...
Secure data protection without hardware lock-in
Infrastructure Information Security News & Events
New Veeam Software Appliance empowers IT teams to achieve instant protection with Veeam’s fully preconfigured, software-only appliance, delivering enterprise-ready simplified deployment and operational efficiency, robust cyber resilience.

Read more...
Check Point launches open, vendor-neutral MDR services
Information Security News & Events Products & Solutions
New Check Point MDR 360° and MXDR 360° offerings deliver 24/7 managed continuous threat monitoring protection across endpoints, cloud and network environments with built-in identity threat detection and 160+ integrations across hybrid, multi-vendor environments.

Read more...
Credential theft surges in South Africa
NEC XON Information Security
NEC XON issues a critical cybersecurity warning about the dual threat of massive credential theft and AI-powered cyberattacks sweeping across the region, with an increasing number of incidents and evolving threat tactics.

Read more...
Want effective Attack Surface Management? Think like an attacker.
Information Security
Effective ASM requires companies to think like attackers, anticipate risks, and act decisively to reduce exposure by knowing their environment, deploying a structured approach, leveraging capable tools, and addressing both internal and external risks.

Read more...
The growing role of hybrid backup
Infrastructure Information Security
As Africa’s digital economy rapidly grows, businesses across the continent are facing the challenge of securing data in an environment characterised by evolving cyberthreats, unreliable connectivity and diverse regulatory frameworks.

Read more...
POPIA non-compliance puts municipalities at risk
Information Security Government and Parastatal (Industry)
Digital responsibility must go beyond POPIA compliance to recognising that privacy and service delivery are fundamentally linked. Despite this, only 51 out of 257 municipalities submitted their mandatory data protection and access to information reports in 2024.

Read more...
Choicejacking bypasses smartphone charging security
News & Events Information Security
Choicejacking is a new cyberthreat that bypasses smartphone charging security defences to confirm, without the victim’s input or consent, that the victim wishes to connect in data-transfer mode.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.