6 Malicious Phishing Campaigns in Action – How COVID-19 Is Being Exploited By Cyber Criminals?
Big Tech giants, intelligence agencies, and security firms, everyone is ringing alarm bells over the growing threat from Cybercriminals in the wake of the COVID-19 pandemic panic. Opportunistic phishing threats, ransomware attacks, and other malicious activities, these criminals are threatening Organizations all around the globe.
Exponentially increasing numbers
According to a recent report by Barracuda Networks, a cloud-enabled security and data protection solution provider, a variety of phishing campaigns are using Covid-19 situation as a lure to trick distracted users, capitalize on the fear and uncertainty of the intended victims, spread malware, steal credentials, and scam users out of money.
As per the reports, the amount of COVID-19-related email attacks has increased by 667 percent since the end of February, this year. A total of 1,188 coronavirus related email attacks were detected in February, while just 137 were detected in the month of January. The researchers at Barracuda detected 467,825 spear-phishing email attacks, between 1st March and 23rd March, and 9,116 of those detections were related to COVID-19, making it nearly 2% of attacks.
6 Malicious Phishing campaigns & scams in action
There’s no rest for security teams and cyber defenders from protecting their colleagues, friends, and families from threats amid the pandemic. Cybercriminals continue to screw the victims, adding onto their busy slate of attacks a host of new coronavirus driven attacks. Since phishing campaigns and scams are skyrocketing amidst the crisis, here are some examples in action that researchers have dug up over the past several months as the situation persists.
1. Government relief fund scams: With government representatives enacting legislation to provide relief funds for those left unemployed or monetarily impacted by COVID-19, cybercriminals are ramping up phishing ploys that imitate government correspondence for funds to trick people into giving up their credentials. These scams have targeted people from all around the world.
2. Imitation of Health Organizations: Savvy criminals have been aiming to piggyback off of the legitimacy of several health Organizations like the World Health Organization (WHO) and Centers for Disease Control (CDC), to design a range of phishing lures. In the month of February, Sophos researchers reported fake advisory emails that used the urgency of the pandemic situation to trick users into exposing credential information.
3. Coronavirus tracking app ransomware: Researchers at DomainTools found that in mid-March, attackers created bogus COVID-19 tracking apps trapped with ransomware. For instance, Dubbed CovidLock was ransomware that was found working by using a screen-lock attack against Android phones. It forced a change in password governing the device’s screen-lock capabilities.
4. COVID-19 Testing Kit scams: COVID-19 testing kits are also being targeted to run a variety of scams. These are spanning across emails, robocalls and there were also text message phishing attempts, according to the Federal Communications Commission (FCC) and Better Business Bureau (BBB). This has run across a range of other robocall scam lures tied to Covid-19, including work-from-home opportunities, debt consolidation, and student repayment plans. Many of these aren’t just targeted toward consumers, but also small Businesses.
5. Face masks and medical supplies: Similar to Covid-19 testing kits, face masks, and other hard-to-find medical supplies are also being used for phishing attempts. According to Bitdefender researchers, in March they ran through a range of new websites that were cropping up with promises of great discounts on masks and other supplies. While some promised limited time offers, others asked for Bitcoin payment to set the hook for desperate victims.
6. DNS Hijacking nudging to phishing sites: Researchers at Bitdefender also discovered targeted DNS hijacking attacks against the home routers that new work-from-home employees depend on for connectivity. The attacks redirected users to coronavirus themed pages that were loaded with malicious info-stealer payloads concealed as COVID-19 informational apps.
Experts at Neumetric, a cybersecurity services, consulting & products Organization, believe that phishing campaigns and scams are a widespread problem that poses a huge risk to individuals and Organizations, especially during the Covid-19 crisis. Needless to say, this is something that everyone needs to be aware of, because these attacks are not going to go away anytime soon. But a little awareness can help keep these cybercriminals at bay.
