{"id":38123,"date":"2020-03-26T11:41:11","date_gmt":"2020-03-26T03:41:11","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=38123"},"modified":"2020-03-26T11:41:12","modified_gmt":"2020-03-26T03:41:12","slug":"sophoslabs-tracks-significant-uptick-in-covid-19-cyber-scams","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2020\/03\/26\/sophoslabs-tracks-significant-uptick-in-covid-19-cyber-scams\/","title":{"rendered":"SophosLabs tracks significant uptick in COVID-19 cyber-scams"},"content":{"rendered":"\n

SophosLabs is tracking how the use of \u201cCOVID-19\u201d and \u201ccoronavirus\u201d in domain names, spam, phishing attacks, and malware has skyrocketed in a new Uncut blog, \u201cFacing down the myriad threats tied to COVID-19.\u201d This article is a \u201clive report\u201d that SophosLabs Uncut will update as findings unfold.<\/strong><\/p>\n\n\n\n

Specifically, the article shows that the volume of \u201cCOVID-19\u201d and \u201ccoronavirus\u201d email scams have nearly tripled in the past week \u2013 see the below chart. <\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Attackers are also increasingly impersonating the World Health Organization (WHO), Centers for Disease Control and Prevention (CDC), North America, and the United Nations (UN), as evidenced in scams tracked by SophosLabs. Attached are a few new examples.<\/p>\n\n\n\n

\u201cCybercriminals are wasting no time in shifting their dirty, tried and true attack campaigns toward advantageous lures that prey on mounting virus fears. It\u2019s easy to see, for example, that the attackers behind a new Chloroquine scam (attached) are the same as those behind a recent herbal Viagra scam,\u201d according to Sophos Principal Research Scientist Chester Wisniewski.  <\/p>\n\n\n\n

\u201cWith global spam volumes estimated to be in the hundreds of billions, for 2-3% of those to be COVID-19 themed is significant. Similar to A\/B testing of advertisements and web pages, criminals often dip a toe in the water when there is a new or sensational topic in the news. If the new topic proves a more effective lure than the previous scam bait they begin switching to new lures.<\/p>\n\n\n\n

\u201cIn fact in one of the spam campaigns we tracked this week, there was evidence of exactly that. These particular criminals had been using fake shipping and delivery emails to convince unsuspecting victims into opening attachments and infecting their computers with the Kryptik Trojan. Now the main body of the email pretends to come from erecruit@who.int<\/a> with “health advice” in the attachment, but when we carefully inspect the plain text body, we see it matches a previous spam campaign from this same criminal using a lure pretending to be about invoices and deliveries.<\/p>\n\n\n\n

\u201cThe increases we are seeing are likely due to two important factors. First, as time passes more and more criminal groups are joining the party on using all this interest in COVID-19 to steal money from people. Secondly, it takes time. Any given criminal group has to handcraft the spams to convince the recipient to take an action. In the research community we call this the call to action. The call to action might be to open the attachment, visit the website or, in the case of the WHO Bitcoin scam (attached), to donate cryptocurrencies to criminal controlled Bitcoin wallets. Crafting these messages takes time, especially for those who are not native English speakers.<\/p>\n\n\n\n

\u201cEven the most innocuous mention of something by a politician or a celebrity can lend a scam credibility or present a new business opportunity. Two recent examples come to mind. One spam campaign offering to tell you about the government cover up and attempting to sell you a COVID-19 survival guide used celebrity Gwyneth Paltrow as a lure in its subject line. A tipoff the email is a fake is the incorrect spelling of her first name as Gwenith (attached), but this could easily be missed or glossed over. A few days ago President Donald Trump mentioned the possible efficacy of a drug called Chloroquine against Coronavirus immediately leading to WordPress blog comment spammers switching from pitching herbal Viagra to instead attempting to sell you Chloroquine, which can be quite dangerous when not taken under the supervision of a doctor. And within only two days of the WHO creating a charity called the Solidarity Response Fund, criminals were soliciting Bitcoin donations pretending to be the charity, even implying your donation is fully tax deductible in the US or Europe.\u201d<\/p>\n\n\n\n

SophosLabs<\/a> has uncovered a variety of different malicious email campaigns connected to COVID-19, including:<\/p>\n\n\n\n