Threat Update: Coronavirus Used in Cyber Attacks

COVID-19 is a type of coronavirus that has been front-page news for the last two months. Whenever there is global news, there is an opportunity for cybercriminals to take advantage of the news cycle to perform fraud, issue cyberattacks or to use the news to lure people to fall victim to their toolset. This advisory summarizes a number of attacks that have used COVID-19 and “Coronavirus” as a pretext for attacks, and insight from ZeroFOX data into COVID-19 being used to stage potentially malicious domains.

Recommendations

Consider monitoring news related to the COVID-19 coronavirus using the ZeroFOX platform, and contact your ZeroFOX Account Manager on enabling rules or use cases if you have a specific business or security need
Be wary of misinformation related to COVID-19 news, and use reputable sources such as WHO and the CDC for up to date and accurate information about COVID-19
Instruct employees to be wary of COVID-19 and coronavirus-themed emails and messages as a pretext for cyberattacks

Details

COVID-19, also known as “Coronavirus”, is an infectious disease that is closely related to SARS. With its ability to spread much like the flu, lack of scalable containment procedures in certain countries, and its effect on the US stock market, it is certainly at the forefront of news and conversations across the world.

This news makes COVID-19 an attractive pretext that can be leveraged by malicious actors in a variety of ways. Threatpost, for example, outlined an Emotet campaign that used Coronavirus themed emails to get victims to click on the delivered maldocs. Kaspersky reported phishing campaigns using look-alike domains to the CDC to attack individuals.

Using the ZeroFOX domain data source, which collects a variety of data sources for domain names, Alpha Team issued keyword queries for covid19, covid-19 and coronavirus.

Figure 1 - Domains that contain covid19

Figure 2 - Domains that contain covid-19

Figure 3 - Domains that contain coronavirus

Figure 1 & 2 show domains being collected with variants of covid19, whereas Figure 3 shows domains using the virus’ alternative descriptor, coronavirus. This could indicate that domains with coronavirus in the name are easier for people to fall victim to rather than COVID-19. According to Google Trends, coronavirus has had much more interest than covid19 or covid-19 variants, even after WHO assigned COVID-19 as the official name on February 11 2020.

Figure 4 - Google Trends Search

The blue line represents search interest for Coronavirus, while red and yellow represent COVID-19 and COVID19, respectively. The Google trend data, when compared with the ZeroFOX domain data, could indicate that people are more familiar with the term “Coronavirus” and because of this, cybercriminals registering potentially malicious domains are more likely to get clicks or interest using coronavirus. Due to the trend data, the domain data, as well as multiple reports of the use of COVID-19 as a pretext for attacks, it is almost certain that malicious actors will continue to use the news of Coronavirus as a way to deliver cyber attacks.