Cyber Attackers—Taking Advantage of COVID-19 Fears

Cyber attackers have reminded us of all the types of adversaries we are up against by using COVID-19 as an opportunity to exploit human distress for profit.

At a time when people and organisations around the world are pivoting their businesses, transitioning to a fully-remote workforce, and worrying about the health and safety of their families, friends, colleagues and themselves, cyber attackers have used this as an opportunity for their benefit.

One of the reasons we founded Right-Hand Cybersecurity was to help educate people about the cyber threat landscape today. If we can understand cyber attackers, it will make people and businesses stronger at defending against them.

Growing up as a competitive water polo player, I watched films of my competitors, attended their matches, and even executed simulations of their plays to condition my mind for a real-world scenario. I conducted deep reconnaissance of my opponent and their tactics to gain an advantage.

Cybercriminals utilise a similar approach in the early stages of a cyber attack.

Today, there is endless information online about our businesses and ourselves. We share names, email addresses, job titles, birthdays, interests and much more online, making this data readily available for anyone who has access to the internet.

Before executing a cyber attack, cybercriminals will conduct reconnaissance on their target. They want to understand the types of information that might be important and relevant to a specific individual. By obtaining this information, a spear-phishing email sent by a cyber attacker could look so realistic a recipient might not think twice before clicking on a malicious URL, downloading a weaponised attachment, or submitting their credentials. These simple actions that only require one moment to execute could have long-term catastrophic financial, reputational, and operational impact on a business or an individual evidenced by the IBM report that states the average cost of a data breach is worth US$3 million.

Governments around the world are releasing stimulus packages and programmes to try and uplift their economies. Health institutions are publishing frequent advisory notices and recommendations to contain the exposure of the virus. Media outlets are distributing updates on the evolving climate of COVID-19. Organisations are communicating business pivots and continuity plans to their employees located around the world. And people everywhere are on high alert, absorbing this information with the intent of protecting their families and themselves. No doubt it is an emotional time, but emotions can sometimes trigger lapses in judgement.

This is music to a cyber attacker’s ears.

There has been a significant uptick in phishing emails globally, aimed at manipulating people’s fear by sending emails that appear to be from governments, health institutions, media outlets, and businesses, all rooted with malicious cyber intent.  According to Forbes, there has been a 667% increase in spear-phishing attacks related to COVID-19 since February this year.

As businesses transit to a fully-remote workforce, they are relying heavier on online communications and collaborative tools. We have seen an exponential increase in Zoom users in the past two months. And this transition, while necessary, also greatly broaden the attack surface by allowing cyber attackers to find new ways to execute their mission.

There have been many use cases in 2020 about Zoom bombing, or the unwanted intrusion of a cyber attacker into a private video conference call. This has caused Zoom, and other video conferencing and communication platforms, to massively uplift their security measures and educate their client base to protect them and deter away cybercriminals. Zoom has essentially become a common attack vector, similar to email.

Historically, roughly 90% of data breaches start with a phishing email. And while email continues to be the top and most commonly used attack vector for cybercriminals, it will be worthwhile to monitor how COVID-19 shifts the attack landscape in the long term based on the new waves of attacks being carried out recently.

Education is critical to protect ourselves and our businesses effectively. Learning about an attacker’s tactics, techniques and procedures (TTP’s), understanding their motivations, and accepting that everyone is a potential target will empower people and businesses to more vigilantly identifying and thwart attacks.

Here are three simple steps everyone can implement from home to increase their defence against malicious cyber attackers:

1. Enable Multi-Factor Authentication on every email account and application. This is an additional, and free, layer of security that can be configured through application Settings.
2. Utilise a Virtual Private Network (VPN) solution on your PC, laptop and/or mobile device to create an encrypted network connection.
3. Critical thinking is more important now than ever. It is easy to fall into ‘cruise control’ during a long day of work, especially while at home, and try to respond to your mounting emails as quickly as possible. Hover over URLs before you click them, and if you’re ever in doubt, listen to your instincts.

In today’s world, we must prepare ourselves to be more vigilant against cyber attacks. Here at SGInnovate, we hold cybersecurity workshops regularly.

Right-Hand Cybersecurity is one of our portfolio companies.