It’s hard to tell who’s benefitting most from the coronavirus – Russia, hackers or hand sanitizer vendors, the latter of whom are at least trying to help stop the spread of the dangerous disease.
A State Department official told Congress Thursday that Russian operatives are behind coronavirus conspiracy theories popping up on social media while the new illness has prompted phishing campaigns and other cybersecurity hijinks.
The coordinator for the State Department’s Global Engagement Center, Lea Gabrielle, said the “entire ecosystem of Russian disinformation is at play,” after an analysis of millions of tweets showed that known conspiracy theories about coronavirus “amounted to about seven percent of the Twitter conversation” between January 10 to February 20.
Some of the usual bad actors are looking to capitalize on fears over the virus. Check Point reported that “the most prominent Coronavirus-themed campaign targeted Japan, distributing Emotet – the leading malware type for the fourth month running – in malicious email attachments feigning to be sent by a Japanese disability welfare service provider” with the emails appearing “to be reporting where the infection is spreading in several Japanese cities, encouraging the victim to open the document which, if opened, attempts to download Emotet on their computer.”
Trickbot’s operators trained their efforts on Italy, where coronavirus has spread to 3,800 people with 148 deaths reported. Recent messages aimed at Italian email addresses carry “a document purported to be a list of precautions to take to prevent infection” but is actually “a weaponized Word document, carrying a Visual Basic for Applications (VBA) script that carries a dropper used to deliver a new Trickbot variant,” Sean Gallagher, senior threat researcher at Sophos, wrote in a blog post. “With concerns about COVID-19 on the rise – particularly in Italy, where cases are surging – the spam campaign’s subject line is now in tune with the concerns of the day.
The emails, purporting to be from “Dr. Penelope Marchetti” read:
Due to the fact that cases of coronavirus infection are documented in your area, the World Health Organization has prepared a document that includes all necessary precautions against coronavirus infection. We strongly recommend that you read the document attached to this message!
Proofpoint, which has seen an uptick in activity around Coronavirus, wrote in a blog post that “the most notable developments we’ve seen are attacks that leverage conspiracy theory-based fears around purported unreleased cures for Coronavirus and campaigns that abuse perceived legitimate sources of health information to manipulate users.”
In an in-person interview on February 11, Sherrod DeGrippo, senior director of threat research and detection, told SC Media that the company is now seeing a new coronavirus email phishing campaign “every couple of days,” and predicted that more will come.
So far, the campaigns have tended to use a mix of lures, some of which are coronavirus-themed, while others are more conventionally designed to look like fake invoices, shipping receipts and résumés. Some have exclusively targeted health care professionals, while others have targeted shipping companies and operators of large freighter fleets, she continued.
“What’s helping [the cybercriminals] is that a lot of HR departments are sending out coronavirus updates for their workforce,” instructing employees to stay home if they are sick, for example. So the phishing emails are “mixing in with the legit HR coronavirus warnings and that makes it harder to tell [the difference] and I think that that’s part of what the threat actor motivation is: ‘Well, we knowyou’re getting a legit one, so we’re gonna send one with malware too.”
IBM Security has noted scams related to the virus since January and a Check Point report revealed registration of domains related to coronavirus has risen, with the company noting in a Thursday blog post that “Coronavirus- related domains are 50 [percent] more likely to be malicious than other domains registered at the same period, and also higher than recent seasonal themes such as Valentine’s Day.”
While cybersecurity pros track malicious incidents and health officials as well as an anxious public mull the potential human toll of the coronavirus and ways to mitigate its impact, organizations are planning for the stress on resources, security challenges and even privacy issues wrought by a pandemic that, among other things, provokes widespread telecommuting.
John Dickson, principal at The Denim Group, told SC Media during a podcast that his company was slated to hold a tabletop exercise to test its computing resources after Dickson returned to the company’s San Antonio, Texas, headquarters in the aftermath of the RSA Conference that AT&T, IBM, Verizon and a slew of other companies had skipped due to coronavirus fears.
“What’s the impact on VPN concentrators,” for example, when everyone is working remotely, Dickson asked. Businesses are really good at using apps like Zoom and WebEx for optimization but mass teleworking will test whether it’s a sustainable model.
JP Morgan Chase this week ordered 10 percent of the employees in its more than 127,000-person strong consumer banking division to stay home, not to avoid spreading the virus but to test its Project Kennedy coronavirus contingency plan.
Companies that aren’t already thinking about business continuity and disaster recovery plans “or doing tabletops on this impact are probably already behind the power curve,” Dickson said.
They’re also likely experiencing “much more of a panic” than those that have properly prepared, Malcolm Harkins, chief security and trust officer at Cymatic, told SC Media during a podcast. While at Intel, Harkins worked on a number of such plans for pandemics and disasters like SARS, Ebola and the earthquake and tsunami in Japan several years back. Those strategies intertwined infosecurity, physical, logical, corporate emergency management, business continuity and disaster recovery.
“It all gets back to risk management,” Harkins said. While companies can’t control pandemics or other disasters, “you can prepare for them."
