Block title

-

Coronavirus-themed security attacks on the increase

- Advertisment -

By Indi Siriniwasa, Vice President at Trend Micro Sub-Saharan Africa

When there is a crisis, there are those who will try and take advantage. Unfortunately, cybercriminals aren’t guided by the same moral compass as the rest of humanity. In fact, they are using the current COVID-19 pandemic to try and break through defences by using scare tactics and a variety of malicious campaigns including email spam, BEC, malware, ransomware, malicious domains, and sending seemingly helpful emails to spread infected files.

Many industries are using remote working as a means to reinforce social distancing, but that means users aren’t always behind their enterprise firewall, which is a problem. It is critical at this time that consumers and remote workers become even more cautious.

Spam
At a time like this, humans are starved for information and will turn to email to get it. But be careful, the coronavirus disease (COVID-19) is being used as bait in email spam attacks on targets around the globe. As the number of those afflicted continues to surge by the thousands, campaigns that use the disease as a lure likewise increase.

As of this week, Trend Micro Researchers uncovered 2814 instances of Coronavirus spam in South Africa alone. The data has been collected from almost 7 000 unique samples out of 41 000 total Corona phishing spam samples reported from Smart Protection Network (SPN) enabled in Trend Micro Messaging products.

In addition, Trend Micro researchers acquired email samples sent to and received from all over the globe, including countries such as the U.S., Japan, Russia and China. These emails are designed to look like they originated from an official health organisation and have updates, recommendations and safety tips. But unfortunately, they also contain malicious attachments.

One particular sample received by our team had the subject “Corona Virus Latest Updates” and claimed to come from the Ministry of Health in the U.S. It was in fact spoofed, contained malware, and was of no use at all. This is just one example. Others include delivery notices asking you to update details, access to a proposed vaccine, and emails asking you to update medical information.

Malware files
Then there are more blatant attacks; our Trend Micro researchers were also able to detect malware with “corona virus” in their filename, including:

  • CORONA VIRUS AFFECTED CREW AND VESSEL.xlsm
  • exe
  • LIST OF CORONA VIRUS VICTIM.exe
  • POEA HEALTH ADVISORY re-2020 Novel Corona Virus.pdf.exe

Malware files are also being seeded in fake news sites that purport to provide updates, dashboards and maps on the spread of the virus. One look at the sudden number of websites that now have the name “corona” in them, and you will see that there is a problem.

BEC
Our researchers were also alerted about a Business Email Compromise (BEC) attack mentioning coronavirus, which was reported by the Agari Cyber Intelligence Division (ACID). Spearheaded by a well-known BEC group called “Ancient Tortoise”, the threat actors targeted accounts receivables by getting them to forward old account reports.

The information was used to send targeted emails under the auspices of legitimate companies to try and collect data. Their hook? These cybercriminals were working under the guise that banking and payment methods needed to be updated in light of COVID-19.

Ransomware
Another example includes a new ransomware variant called CoronaVirus, spread through a site that proposed to assist with cleaning and optimising your system. The Malware HunterTeam exposed this instance.

Those who fell prey to this event unwittingly downloaded the WSGSetup.exe file from the fake site. The executable file inserted a malware downloader for the CoronaVirus ransomware as well as the password-stealing trojan, Kpot.

Secure your defences
Unfortunately, as much as we need to get people comfortable with the concept of working from home, and we have the tools to do so, we also need to arm them with the facts. We need to educate employees that these threats are real, and they may fall prey to disingenuous actors who are feeding off the untenable situation we find ourselves in as a result of this pandemic.

At Trend Micro, we are encouraging our partners and customers to play open cards with their employees, present them with the facts, and update them regularly of the current scams doing the rounds. Most importantly, ensure that the endpoints that are now accessing your systems remotely remain secure.

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest articles

Gateway for industrial automation

SICK Sensors unveils ProfiNet SIG200 IO-Link sensor integration gateway for industrial automation SICK recently announced its new SIG200 ProfiNet sensor integration gateway. The product is...

Africa – the disconnected continent

The IDC market outlook for Africa underscores the value of connectivity, the importance of ICT and the need to be more prepared when it...

Retailers can now experience the agility of SaaS

Retailers can now manage their whole business with one unified commerce software platform in the cloud; they no longer require a different IT system...

New laws to protect personal information

Sections of the POPIA come into effect today, 1 July 2020 Progress is being made to promote the protection of personal information. President Cyril Ramaphosa...

Plumbers meet wireless Sigfox technology

“Plumbers are in the forefront of the water challenges currently facing South Africa, but only a few know how digital solutions can eradicate many...

Working from home, panel discusses challenges

EngineerIT “cyber security, the challenges remotely” panel discussion. Listen here EngineerIT hosted a virtual panel discussion on 25 June 2020, looking at the challenges of...
- Advertisement -

Nordic and Qorvo collaboration to include ultra-wideband

Following Qorvo’s acquisition of ultra-wideband pioneer Decawave, Nordic and Qorvo are expanding their partnership to include dual ultra-wide band (UWB) and Bluetooth® Low Energy...

Out of nowhere, a Global Magnetic Anomaly

In recent times the Earth’s magnetic field has been quiet. Actually, very quiet! The Sun is in the pits of what may turn out...

Scientists say NOW is the time for green recovery

Daily carbon dioxide emissions are spiking again as economies roar back to life from pandemic lockdowns. Scientists worry that countries may miss their chance...

AWS Outposts now available in South Africa

AWS Outposts is now available in South Africa. Outposts delivers fully managed and configurable compute and storage racks built with AWS-designed hardware that allows...

Download the June edition

Read about: Encryption – critical in any defence strategy Encryption is a critical component of a defence-in-depth strategy, which is a security approach with a...