Companies Facing New Threats With Coronavirus

As Coronavirus (COVID-19) spreads, individuals are doing their best to stay up-to-date on the latest news regarding the outbreak. Hackers have created new attacks based on the public interest in this virus. Through our security vendors and partners, Partek has received up to date information on attack vectors that attackers are using in the latest string of phishing and fraudulent attacks. One of the most common attacks is an email impersonation attack. In this attack, the criminal impersonates organizations like the UN World Health Organization (WHO) and the US Centers for Disease Control and Prevention (CDC) to trick users into opening a malicious email. Multiple government organizations have issued warnings against these attacks.

This is not an unusual tactic for hackers, as email scams historically usually follow the headlines. Hackers typically try to monetize on tragedies like hurricanes and other disasters. Most of these scams are designed to do some variation of the following:

• Infect the user device and spread malware
• Steal login credentials by way of a phishing site or other phishing mechanism
• Collect donations for fake charities through malicious websites

The current pandemic has given scammers all those opportunities and more:

• Selling counterfeit versions of medical supplies that are in short supply
• Tricking users into buying fake cures
• Offering investment opportunities in companies claiming to have the cure

Email scammers will continue to find new ways to take advantage of the Coronavirus COVID-19 pandemic. There has been a significant surge in the registration of new domains that use the word ‘coronavirus.’ Some of these will be put to a good use, but many will be used by hackers for malicious purposes. These malicious websites might appear to offer news or advice on coronavirus outbreak but are being used for phishing or to spread malware. Email impersonation scams often include links to this type of site.

Over the past few weeks, our partner, Barracuda Networks, has seen a number of attacks impersonating the World Health Organization. These phishing emails appear to come from WHO with information on COVID-19. They often use domain spoofing tactics to trick users into thinking these messages are legitimate. These email impersonation attacks will include a link in the body of the email.  Users who click on that link are taken to a newly registered phishing website:

 

Increased Risk for Remote Workers

As a preventative measure against the spread of Coronavirus,  many organizations are asking employees to work remotely from home until further notice. These remote workers may rely on email for communication, as well as updates on workplace issues related to the outbreak. This puts users in a state of expectation for email messages from HR or upper management on the subject of the virus. This expectation creates an increased risk for the company because the user is more likely to accidentally open a malicious email if they are expecting a similar legitimate message. These factors, combined with the diminished ability to confirm the legitimacy of an email due to remote working is a perfect environment for email scams.

Protecting Your Organization & Employees

There are several ways to protect your company and employees from email scams, and they are based on employee education and security technology:

• Don’t click on links in email from sources you do not know; they may lead to malicious websites
• Be wary of emails claiming to be from the Government of Canada, CDC, or WHO. Go directly to their websites for the latest information.
• Pay special attention to email messages from internal departments, partners, managers, or executives who send regular updates on the outbreak. Domain and display name spoofing are some of the most common techniques used.
• Never give personal information or login details in response to an email request. This is how a phishing attack leads to business email compromise.
• All malicious emails and attacks should be immediately reported to your IT provider for investigation and remediation.
• Make sure employees receive up-to-date training on the latest phishing and social-engineering attacks.