This report is an update to our first report on COVID-19-related cybersecurity issues published 19 March 2020.
Since our previous report, we have observed continuing efforts from cyber-attackers to exploit the pandemic to their own gains. There are an increasing number of organisations that have been impersonated and an ever-increasing number of malware variants observed being distributed using COVID-19-themed lures.
In addition to phishing and malware email campaigns, there have also been attempts to entice users to make payments to criminally-controlled bank accounts. Prior to the COVID-19 pandemic, so-called "Business Email Compromise" (BEC) fraud attempts were frequent and growing in number. These latest attempts do not mark a step-change in the intensity of these kinds of attacks, but demonstrate the ability of cybercriminals to react with agility and capitalise on the fear and uncertainty surrounding the virus to "socially engineer" users into making payments. We have provided some advice for businesses on how to reduce the risk of these kinds of attacks and how to respond in the event of such an attack, including potential legal options.
We have also seen fake COVID-19 products and misinformation ("fake news") such as sale of a "vaccine", the sale of counterfeit masks, hand sanitizer and other protective equipment. Some emails have also requested "donations" to fake charities tackling the pandemic. In one instance donations were requested in Bitcoin, a clear red flag.
Businesses and employees should remain aware of the heightened threat of the use of these lures and follow the advice provided in our initial report. We expect to see phishing campaigns broaden to include the impersonation of other services such as online payments, retail and food providers in the short to medium-term.
To read our full report click here.
Practical guidance for COVID-19
Read the latest COVID-19 related updates on our hub.