Exploiting World-Wide Crises for Phishing Attacks

Exploiting World-Wide Crises for Phishing Attacks

With news of the recent coronavirus impacting China and spreading to other countries, more and more people are worried about the threat that this poses to them and their families. Threat actors have capitalized on this widespread fear to lure potential victims into clicking on malicious emails or visiting malicious websites.

Recommendations

• Remain vigilant for suspicious emails that may be targeting worldwide issues like the coronavirus
• Ensure you have standard defenses configured in your organization (i.e. 2FA, Anti-Virus/Malware, not reusing passwords, etc.)

Details

Threat actors always try to develop enticing lures for victims to engage with their emails or websites, and with something as widespread and potentially devastating as the coronavirus, they are bound to have some success with this over general lures used. This tactic does not have to be focused on a particular geographic area, however, we would assume that most of this would be directed to the main areas that are impacted. It is possible however for the actors to target places that have not been hit with this virus yet, which could potentially cause more panic since this could signify that the virus has spread.

Along with any convincing lure by threat actors, the more convincing or relevant news or “call to action” that these actors can use, the more successful they could be. Using something that is potentially deadly to individuals like the coronavirus is a great tactic by attackers since there are potential consequences associated with this threat, as opposed to phishing emails saying that someone’s social media account has been compromised.

Figure 1. Breakdown of the types of domains seen registered using names associated with the coronavirus

Some samples have been identified in VirusTotal that are being used by the Patchwork APT group that targets victims located in China with coronavirus lores. The initial vector of delivery is not known, however, there are a few variations of filenames which get dropped on the victim machine, including:

Application Form.xlsm (申请表格.xlsm) Wuhan Travel Information Collection Application Form.xlsm (武汉旅行信息收集申请表.xlsm) Application form for collecting health readiness information.xlsm (收集健康准备信息的申请表.xlsm) Diagnosis and prevention of pneumonia caused by a new coronavirus infection.xlsm (新型冠状病毒感染引起的肺炎的诊断和预防措施.xlsm) Ministry of Health Directive.docx (卫生部指令.docx)

These files above are related to the IP address 45.153.184[.]67, with the files listed above communicating with this IP address, which is a VPS provider located in Cyprus. Additionally, samples related to this malware were seen being hosted on 185.193.38[.]24 as well, which is another hosting company, located in Germany.

Figure 2. VirusTotal graph of IP hosting malicious samples related to coronavirus

Conclusion

The impact of attackers capitalizing on this virus is similar to other phishing emails or malicious sites, in that they are trying to get victims to interact with their email or website in order to compromise them. The only difference here is that this could be more successful than other campaigns using traditional lures to entice victims.

Attackers will always try to think of new methods and ways to get victims to interact with their content. When major world events occur, it's best to trust but verify news you are seeing, and being aware that attackers will most likely try to use the news as a method for getting victims to view their content.