Interpol report highlights “alarming rate” of cyber attacks during COVID-19

With organisations and businesses rapidly deploying remote systems and networks to support members of staff in working from home, criminals are also taking advantage of increased security vulnerabilities in a determined bid to steal data, generate profits and cause disruption.

In one four-month period (from January to April, in fact), some 907,000 spam messages, 737 incidents related to malware and 48,000 malicious URLs – all of them in relation to COVID-19 – were detected by one of Interpol’s private sector partners.

The increased online dependency for people around the world is also creating new opportunities for criminality, with many businesses and individuals not ensuring their cyber defences are up-to-date. The report’s findings again underline the need for closer public-private sector co-operation if the threat posed by COVID-19 to organisations’ ongoing cyber health is going to be met.

Key findings highlighted by the detailed Interpol assessment of the cyber crime landscape in relation to the COVID-19 pandemic include the following:

Online Scams and Phishing

Threat actors have revised their usual online scams and phishing schemes. By deploying COVID-19 themed phishing e-mails, often impersonating Government and health authorities, cyber criminals entice victims into providing their personal data and downloading malicious content. Around two-thirds of member countries which responded to the global cyber crime survey have reported a significant use of COVID-19 themes for phishing and online fraud since the outbreak

Disruptive Malware (Ransomware and DDoS)

Cyber criminals are increasingly using disruptive malware against critical infrastructure and healthcare institutions due to the potential for high impact and financial benefit. In the first two weeks of April, there was a spike in ransomware attacks by multiple threat groups which had been relatively dormant for the past few months. Law enforcement investigations show the majority of attackers estimated quite accurately the maximum amount of ransom they could demand from targeted organisations

Data Harvesting Malware

The deployment of data harvesting malware such as remote access trojans, info stealers, spyware and banking trojans by cyber criminals is on the rise. Using COVID-19 related information as a lure, threat actors infiltrate systems and attempt to compromise networks, steal data, divert money and build botnets

Malicious Domains

Taking advantage of the increased demand for medical supplies and information on COVID-19, there has been a significant increase in cyber criminals registering domain names containing keywords such as ‘Coronavirus’ or ‘COVID’. These fraudulent websites underpin a wide variety of malicious activities including C2 servers, malware deployment and phishing. From February through to March, a 569% growth in malicious registrations (including malware and phishing) and a 788% growth in high-risk registrations were detected and reported to Interpol by a private sector partner

Misinformation

An increasing amount of misinformation and fake news is spreading rapidly among members of the public. Unverified information, inadequately understood threats and conspiracy theories have contributed to anxiety in communities and, in some cases, facilitated the execution of cyber attacks. Nearly 30% of countries which responded to the global cyber crime survey confirmed the circulation of false information related to COVID-19. Within a one-month period, one country reported 290 postings with the majority containing concealed malware. There are also reports of misinformation being linked to the illegal trade of fraudulent medical commodities. Other cases of misinformation involved scams via mobile text messages containing ‘too good to be true’-style offers such as free food, special benefits or large discounts in supermarkets.

Future primary areas of concern highlighted by the Interpol report include the following:

*A further increase in cyber crime is highly likely in the near future. Vulnerabilities related to working from home and the potential for increased financial benefit will witness cyber criminals continuing to ramp up their activities and develop more advanced and sophisticated modus operandi

*Threat actors are likely to continue proliferating Coronavirus-themed online scams and phishing campaigns in order to leverage public concern about the pandemic

*Business e-mail Compromise schemes will also likely surge due to the economic downturn and shift in the business landscape, in turn generating new opportunities for criminal activities

*When a COVID-19 vaccination is eventually made available, it’s highly probable that there will be another spike in phishing related to these medical products as well as network intrusion and cyber attacks specifically designed to steal data