Since the outbreak of Covid-19, every country in the world has seen at least one virus-themed cyberattack – and the volume of successful attacks seems to be increasing – ©123RF.com
Cybercriminals are taking advantage of Covid-19
Microsoft has unveiled Asia Pacific findings from the latest edition of its Security Endpoint Threat Report, which reveal that cybercriminals are making 60,000 Covid-19 related phishing attempts every day.
Despite New Zealand remaining one of the least targeted countries in the region for cyberattacks, recent high-profile attacks in this country demonstrate the need to remain vigilant.
“The Microsoft Security Endpoint Threat Report aims to create a better understanding of the evolving threat landscape and help organisations improve their cybersecurity posture by mitigating the effects of increasingly sophisticated attacks,” says Russell Craig, national technology officer for Microsoft New Zealand.
The findings were derived from an analysis of diverse Microsoft data sources, including 8 trillion threat signals received by Microsoft every day from January to December 2019. However, with the turn of the new year, Covid-19 has changed the landscape and remains the top-of-mind concern for individuals, organisations and governments around the world.
Since the outbreak, the Microsoft intelligence protection team’s data has shown that every country in the world has seen at least one Covid-19 themed attack, and the volume of successful attacks seems to be increasing, as fear and the desire for information grows.
Capitalising on fear
Of the millions of targeted phishing messages seen globally each day, roughly 60,000 include Covid-19 related malicious attachments or malicious URLs. Attackers are impersonating established entities like the World Health Organization (WHO), Centers for Disease Control and Prevention (CDC), and the Department of Health to get into in-boxes.
“According to our data, we found that Covid-19 themed threats are mostly re-threads of existing attacks that have been slightly altered to tie to the pandemic,” Mr Craig explains. “This means that attackers have been pivoting their existing infrastructure, like ransomware, phishing and other malware delivery tools, to include Covid-19 keywords, to capitalise on people’s fear. Once users click on these malicious links, attackers can infiltrate networks, steal information and monetise their attacks.”
The Asia Pacific region continued to experience a higher-than-average encounter rate for malware and ransomware attacks – 1.6 and 1.7 times higher than the rest of the world, respectively. However, there is good news for New Zealand, which registered the second-lowest malware encounter rate across the region at 1.24% in 2019, a 39% decrease from the previous year.
New Zealand also registered an all-time-low ransomware encounter rate of 0.01%, and the lowest volume of drive-by download attacks, at near-zero. These attacks involve downloading malicious code onto an unsuspecting user’s computer when they visit a website or fill out a form. The malicious code is then used by an attacker to steal passwords or financial information.
Despite this, Mr Craig says a low threat is not the same as no threat when it comes to cybercrime. New Zealand’s Computer Emergency Response Team (CERT) has reported recent attacks affecting businesses operating in New Zealand, including brewery Lion, Fisher and Paykel, BlueScope Steel, transport and logistics company Toll Group (which was also targeted earlier in 2020) and Honda.
Mr Craig says this demonstrates why all businesses need to remain vigilant, especially as more have adopted remote working. “With more employers shifting to modern workplace models that enable remote working in the wake of Covid-19, we’re seeing gains in wellbeing, flexibility and productivity, but every remote device is also a new potential access point to businesses’ IT platforms. Meanwhile, we’re now seeing attackers taking a more customised approach, targeting specific geographies, industries and businesses, as well as taking advantage of the desire for more Covid-related information,” he says.
“New working models require up-to-date security, which means leveraging cloud technology and developing a comprehensive cyber resilience strategy. Everyone, both businesses and individuals, has a role to play in keeping their organisation safe.”
How to spot fake emails
CERT says coronavirus-themed phishing emails often include infected attachments containing fictitious ‘safety measures’. Instead of the link containing health information, it instead installs malicious software on the recipient’s device that is designed to steal personal information.
Other emails encourage people to fill in their email and password before they can get information on Covid-19. They claim to be able to provide information on new cases of Covid-19 in the recipient’s city and a guide on pandemic survival. These are not legitimate, and instead are an attempt to steal personal information.
Some scam emails ask recipients to pay money to the sender or they will circulate video footage of the recipient in compromising positions. This is a common scam, but newer variations are threatening to spread Covid-19 to their family if they don’t pay the ransom. The emails are designed to scare the recipient into paying the money.
Security researchers have also identified a new campaign where the attackers claim to have a ‘coronavirus map’ application that people can download onto their devices. Instead, the application is malware, designed to steal sensitive information from the device it is downloaded onto, such as passwords.
Protect your businessMicrosoft recommends the following preventative measures for businesses:
- • Have strong tools to safeguard employees and infrastructure – this means looking into multi-layered defence systems and turning on multi-factor authentication (MFA) as employees work from home
- • Enable endpoint protection and protect against shadow IT and unsanctioned app usage with solutions like Microsoft Cloud App Security
- • Ensure employee guidelines are communicated clearly to employees – this includes information on how to identify phishing attempts, distinguishing between official communications and suspicious messages that violate company policy, and where these can be reported internally
- • Choose a trusted application for audio/video calling and file sharing that ensures end-to-end encryption
- • Update all devices with the latest security updates and use an antivirus or anti-malware service
- • Be alert to links and attachments, especially from unknown senders.