Phishing Attacks in the name of COVID-19

Although we might not want to think about our world having people that benefit on the suffering of others, regretfully they are out there and lots of them.  So we need to be compassionate but also vigilant.  Of course, the bad guys will try to take advantage of this situation to try and do bad things.  I truly believe in Preventive Maintenance and Education, so if and when they try to fool us, we are ready for them and do not compromise our information.  Here is some information of what is being seen in the IT world. 

BE VIGILANT AND SMARTER THAN THEM.   

The Three Waves

We thought it might be useful to do a quick review of the development of COVID-19-themed phishing emails that we’ve been tracking since early February.

Looking back, we can now discern three distinct waves of phishing emails reported by customers.

1. The first wave, which began growing slowing over the course of February and early March, mainly involved straightforward spoofs of the CDC (Centers for Disease Control), WHO (World Health Organization), and a few other reputable authorities including HR departments within targeted organizations. These spoofs generally purported to offer information and updates on the unfolding crisis, leveraging the trust vested in those spoofed authorities to trick users into clicking through links and attachments to malicious content (mostly credentials phishes, but occasionally malware, including Emotet).

During that time period we also observed a rather predictable rise in spam/scam emails trading on fear and confusion to push the usual variety of dodgy products and services — fake vaccines, price-gouged health care products (masks, sanitizers), as well as books, videos, and bogus “miracle cures.”

2. In the second wave, malicious actors began experimenting with new and novel social engineering schemes — some more successful and convincing than others. If nothing else, though, this second wave demonstrated that the bad guys were seriously committed to exploiting the chaos and growing hysteria over the spread of virus by rapidly developing a larger menu of phishing templates.

We covered the first and second waves of Coronavirus phishes in our earlier blog pieces. This second wave, in particular, proved to be relatively brief and was soon overtaken by a massive wave of new virus-themed phishing emails that crashed into users’ inboxes starting Wednesday and Thursday.

3. The third wave, which arrived mid-week, saw the bad guys building out their repertoire of customized social engineering schemes by re-purposing a wide variety of older phishing emails — all those golden oldies so depressingly familiar to end users and IT departments alike, now newly re-invigorated and sent into battle once again under the banner of the mighty Coronavirus.

BE SAFE AND BE VIGILANT!