printer friendly version

Coronavirus-themed security attacks on the increase

When there is a crisis, there are those that will try and take advantage. Unfortunately, cybercriminals aren't guided by the same moral compass as the rest of humanity. In fact, they are using the current COVID-19 pandemic to try and break through defences by using scare tactics and a variety of malicious campaigns including email spam, malware, ransomware, malicious domains, and sending seemingly helpful emails to spread infected files.

Locally, South Africa’s president, Cyril Ramaphosa has urged the nation to remain in isolation so that we can contain the virus in an attempt to minimise the widespread devastation the world is bearing testament to.

All industries are using remote working as a means to reinforce social distancing, but that means users aren't always behind their enterprise firewall, which is a problem. While we are no medical experts, we are security experts, and it is critical at this time that consumers and remote workers become even more cautious.

Spam

At a time like this, humans are starved for information and will turn to our email to get it. But be careful, the coronavirus disease (COVID-19) is being used as bait in email spam attacks on targets around the globe. As the number of those afflicted continue to surge by thousands, campaigns that use the disease as a lure likewise increase.

As of this week, Trend Micro Researchers uncovered 2 814 instances of Coronavirus spam in South Africa alone. The data has been collected from almost 7 000 unique samples out of 41 000 total Corona Phishing Spam samples reported from Smart Protection Network (SPN) enabled in Trend Micro Messaging products.

In addition, Trend Micro researchers acquired email samples sent to and received from all over the globe, including countries such as the U.S., Japan, Russia, and China. These emails are designed to look like they originated from an official health organisation and have updates, recommendations, and safety tips. But unfortunately, they also contain malicious attachments.

One particular sample received by our team had the subject 'Corona Virus Latest Updates' and claimed to come from the Ministry of Health in the U.S. It was in fact spoofed, contained malware, and was of no use at all. This is just one example. Others include delivery notices asking you to update details, access to a proposed vaccine, and emails asking you to update medical information.

Malware files

Then there are more blatant attacks, our Trend Micro researchers were also able to detect malware with 'corona virus' in their filename. Including:

• CORONA VIRUS AFFECTED CREW AND VESSEL.xlsm

• CoronaVirusSafetyMeasures_pdf.exe

• LIST OF CORONA VIRUS VICTIM.exe

• POEA HEALTH ADVISORY re-2020 Novel Corona Virus.pdf.exe

Malware files are also being seeded in fake news sites that purport to provide updates, dashboards and maps on the spread of the virus. One look at the sudden number of websites that now have the name 'corona' in them, and you will see that there is a problem.

Business email compromise

Our researchers were also alerted of a Business Email Compromise (BEC) attack mentioning coronavirus, which was reported by the Agari Cyber Intelligence Division (ACID). Spearheaded by a well-known BEC group called 'Ancient Tortoise', the threat actors targeted accounts receivables by getting them to forward old account reports.

The information was used to send targeted emails under the auspices of legitimate companies to try and collect data. Their hook? These cybercriminals were working under the guise that banking and payment methods needed to be updated, in light of COVID-19.

Ransomware

Another example includes a new ransomware variant called CoronaVirus, spread through a site that proposed to assist with cleaning and optimising your system. The Malware HunterTeam exposed this instance. Those who fell prey to this event unwittingly downloaded the WSGSetup.exe file from the fake site. The executable file inserted a malware downloader for The CoronaVirus ransomware as well as the password-stealing trojan, Kpot.

Secure your defences

Unfortunately, as much as we need to get people comfortable to the concept of working from home, and we have the tools to do so, we also need to arm them with the facts. We need to educate employees that these threats are real, and they may fall prey to disingenuous actors who are feeding off of the untenable situation we find ourselves in as a result of this pandemic.

At Trend Micro, we are encouraging our partners and customers to play open cards with their employees, present them with the facts, and update them regularly of the current scams doing the rounds. Most importantly, ensure that the endpoints that are now accessing your systems remotely remain secure.

Share this article:

Further reading: