7 Ways Hackers and Scammers Are Exploiting Coronavirus Panic

Unfortunately, to some extent, it’s working, and that’s because
the attack surface is changing and expanding rapidly as many
organizations and business tasks are going digital without much
preparation, exposing themselves to more potential threats.

Most of the recent cyberattacks are primarily exploiting the
fears around the COVID-19 outbreak—fueled by disinformation and
fake news—to distribute malware via Google Play
apps, malicious links and attachments, and execute ransomware
attacks.
^[1]

Here, we took a look at some of the wide range of unseen threats
rising in the digital space, powered by coronavirus-themed lures
that cybercriminals are using for espionage and commercial gain.

The latest development adds to a long list of
cyberattacks^[2] against hospitals and
testing centers, and phishing campaigns that aim to profit off the
global health concern.

Coronavirus-themed Digital Threats

“Every country in the world has seen at least one COVID-19 themed
attack,” said Rob Lefferts,
corporate vice president for Microsoft 365 Security. These attacks,
however, account for less than 2% of all attacks analyzed by
Microsoft on a daily basis.

“Our data shows that these COVID-19 themed threats are retreads
of existing attacks that have been slightly altered to tie to this
pandemic,” Lefferts added. “This means we’re seeing a changing of
lures, not a surge in attacks.”

1 — Mobile Malware

Check Point Research uncovered at least 16 different mobile apps,
which claimed to offer information related to the outbreak but
instead contained malware, including adware (Hiddad) and banker
Trojans (Cerberus), that stole users’ personal information or
generated fraudulent revenues from premium-rate services.

“Skilled threat actors are exploiting people’s concerns about
coronavirus to spread mobile malware, including Mobile Remote
Access Trojans (MRATs), banker trojans, and premium dialers, via
apps which claim to offer Coronavirus-related information and help
for users,” Check Point Research said in a report shared with The
Hacker News.

All the 16 apps in question were discovered on newly created
coronavirus-related
domains^[4], which have seen a
huge
spike^[5] over the past few
weeks.

2 — Email Phishing

In a separate report published
today and shared with The Hacker News, cybersecurity firm Group-IB
claims to have found that most COVOD-19 related phishing emails
came with AgentTesla (45%), NetWire (30%), and LokiBot (8%)
embedded as attachments, thereby allowing the attacker to steal
personal and financial data.

3 — Discounted off-the-shelf Malware

Group-IB’s research also found more than 500 posts on underground
forums where users offered coronavirus discounts and promotional
codes on DDoS, spamming, and other malware services.
This is consistent with Check Point Research’s earlier
findings of hackers promoting their exploit tools on the
darknet with ‘COVID19’ or ‘coronavirus’ as discount codes.

4 — SMS Phishing

The US Cybersecurity and Infrastructure Security Agency (CISA) and
the UK’s National Cyber Security Centre (NCSC) also issued a
joint advisory about
fake SMS messages from senders such as “COVID” and “UKGOV” which
contain a link to phishing sites.

5 — Face Mask and Hand Sanitizer Scams

Europol recently arrested a
39-year-old man from Singapore for allegedly attempting to launder
cash generated from a business email scam (BEC) by posing as a
legitimate company that advertised the fast delivery of FFP2
surgical masks and hand sanitizers.

6 — Malicious Software

As people increasingly work from home and online communication
platforms such as Zoom and Microsoft Teams become crucial, threat
actors are sending phishing emails that include malicious files
with names such as “zoom-us-zoom_##########.exe” and
“microsoft-teams_V#mu#D_##########.exe” in a bid to trick people
into downloading malware on their devices.

7 — Ransomware Attacks

The International Criminal Police Organization (Interpol)
warned member countries that cybercriminals are attempting to
target major hospitals and other institutions on the front lines of
the fight against COVID-19 with ransomware.

“Cybercriminals are using ransomware to hold hospitals and
medical services digitally hostage, preventing them from accessing
vital files and systems until a ransom is paid,” Interpol said.

Protecting Yourself from Coronavirus Threats Online

“Malicious cyber actors are continually adjusting their tactics to
take advantage of new situations, and the COVID-19 pandemic is no
exception,” CISA said.

“Malicious cyber actors are using the high appetite for
COVID-19-related information as an opportunity to deliver malware
and ransomware, and to steal user credentials. Individuals and
organizations should remain vigilant.”

The NCSC has offered
guidance^[13] on what to look out for
when opening coronavirus-themed emails and text messages that
contain links to such fake websites.

In general, avoid clicking on links in unsolicited emails and be
wary of email attachments, and do not make meetings public and
ensure they are protected by passwords to prevent videoconferencing
hijacking.

A running list of malicious websites and email addresses can be
accessed
here^[14]. For more tips on how
to protect yourself from COVID-19 related threats, you can read
CISA’s
advisory^[15] here.

^{[3][6][7][8][9][10][11][12]}