Attackers are using this time of crisis to go after victims with targeted campaigns. The biggest threats are phishing attacks related to COVID-19. Attackers are also setting up COVID-19-related domain names and enticing people to click on them.[ Find out how 4 deception tools deliver truer network security. | Get the latest from CSO by signing up for our newsletters. ]
Anomali recently released a report that identified at least 15 distinct COVID-19-related campaigns associated with 11 threat actors distributing 39 different malware families and employing 80 MITRE ATT&CK techniques. In January, the attacks typically were malicious emails that appeared to be notifications from welfare providers and public health sectors. In February, the attacks shifted to include remote access trojans (RATS). CheckPoint reported in March an increase of fraudulent COVID-19-themed domains. In mid-March, researchers noted that attackers were mimicking the Johns Hopkins coronavirus map.
Recently, Microsoft noted several themed attack trends on the networks that it monitors.
Phishlabs reported that cyber criminals are using COVID-19 related voicemail notifications to trick people to log in and steal credentials. Trustwave reported that COVID-19-themed business email compromise (BEC) scams are increasing. The UK’s National Cyber Security Centre (NCSC) indicates that attackers also target remote access and home user entry points.
What actions can you take to ensure that your employees and your network won’t be targeted? Plenty:
Protect endpoints: Enable Microsoft Defender ATP, which is available with a Windows 10 E5 license or Microsoft 365 Enterprise license, or a third-party endpoint protection tool. This includes home machines.
Enable multi-factor authentication (MFA) for online Exchange and email: Microsoft recently pushed off disabling basic authentication as a result of the COVID-19 impact on organizations, a decision I disagree with. Attackers go after POP, IMAP and basic authentication on Office 365 targets. They will use password spray attacks and password reuse to break into your network.
This is why you should disable basic or legacy authentication and support modern authentication. Also, use conditional access policies to block older vulnerable authentication methods.
Having MFA on your email ensures that attackers can’t use the easy attacks on your organization. You can set a rule that anyone logging in from the static IP addresses of the office locations are not prompted by MFA prompts, ensuring that this protection is focused on remote entry points that attackers target the most. Also consider adding geographic log in limitations via conditional access rules to better protect your network as well.
Have email filtering or hygiene between your firm’s mailboxes and the outside world: Whether it’s Office ATP or another filtering service, ensure that you are protecting what is increasingly a huge targeted attack surface: phishing attacks in your inbox.
Reach out to other resources to learn and share what you are seeing in your organization: A group of security researchers have banded together to share risks and threats under the banner of the COVID-19 Cyber Threat Coalition. Review its weekly recap or sign up for its Slack channel to share information and resources.
The coalition has provided a master listing of malicious domains and URLs that you can use in your network firewall rules.
Attack domains cataloged by the COVID-19 Cyber Threat Coalition
Don’t forget to check out the resources on the IDG TechTalk channel.
More on network security:
This story, “4 tips for protecting users from COVID-19-targeted attacks” was originally published by
Copyright © 2020 IDG Communications, Inc.