Year in Review: COVID-19 Concerns for Cybersecurity

Note: This blog is a follow-up on our remote worker series on navigating security as organizations continue to work from home and cybercriminals increase the sophistication and variety of tactics used to obtain illicit access to systems, How Cybercriminals Are Taking Advantage Of COVID-19: Scams, Fraud, And Misinformation, Companies and Verticals at Risk for COVID-19 Attacks, COVID-19, Remote Working, and the Future of Cybersecurity.

A one-year anniversary is a very significant thing; it can mean a fancy dinner and a bottle of wine, a LinkedIn post filled with congratulatory comments, or an occasion to throw a party for friends and family. However, the one-year mark since COVID-19 was declared a national emergency in the US hardly triggers a celebratory mood. It does, however, provide a milestone moment to reflect. The past year has fundamentally altered both the ways we work and the cyber threat landscape across the globe.

After a full year of observing the cyber threat landscape evolving under work from home orders and vaccine development and roll-out, we identified the top 3 COVID-19 concerns for cybersecurity shared in this article.

Remote Workers and Continued Targeting of VPNs and RDPs

Virtual Private Network (VPN) and Remote Desktop Protocol (RDP) tools are undeniably indispensable tools for the remote workforce, giving access to private networks and control of local admin systems without having to be in office. Unfortunately, these tools can also be rife with vulnerabilities such as unpatched software or weak login credentials.

Since the start of the pandemic, VPNs have been thrust into the spotlight in the cybercriminal realm. The targeting of VPNs has become so severe that the FBI and Central Infrastructure Security Agency (CISA) release an advisory in response to the cybercriminal advantages in telework. In this notice, they recommended restricting VPN access devices and hours, employing domain monitoring, and active monitoring of web applications to uncover “unauthorized access, modification, and anomalous activities.” While access to a VPN may not seem like much, it is a goldmine for access to proprietary data, offering attackers an entire suite of employee credentials. Since the start of 2020, Digital Shadows (now ReliaQuest)’ Photon research team observed Virtual Private Network (VPN) accesses become one of the top three accesses listed for sale in cybercriminal forums, with the average price per set around $3,000.

Once relegated to IT support tasks, Remote Desktop Protocol (RDP) tools are commonplace as millions follow stay-at-home orders or operate on a hybrid remote working model. RDP use is a new concept for many organizations, and thus IT security policy around them is haphazard or relaxed at best. In some cases, login credentials for TeamViewer or LogMeIn tools are standardized across organizations for ease of access. Such was the case at the Florida water treatment center when a shared TeamViewer credential almost caused the city of Oldmar’s water supply to be poisoned.

Get our free research report, Initial Access Brokers: An Excess of Access here.

COVID-19 Phishing Sites and VIP/VIO Impersonations

At the start of the COVID-19 pandemic, many cybercriminals in online forums sympathized with the crisis and vowed to not target medical organizations working towards COVID care or vaccine development:

Translation of the above: Funeral services (Morgues, crematoria, funeral homes) and Medicine (only: hospitals, hospitals, any palliative care organization, nursing homes, companies that develop and participate (largely at the supply chain level) in the distribution of the COVID-19 vaccine) are banned from ransomware operations.

While you can read more about forum opinions in our post Dark Web Reaction to COVID-19, most cybercriminal forums were in agreement that launching attacks on hospitals and healthcare systems was bad. Still, this did not stop attackers from taking direct advantage of COVID-19 by using it as a phishing campaign lure. Attackers love a good phishing scheme: a simple email template, a look-a-like web page, and suddenly they’ve harvested a valuable credential, payment card information, or use personal identifiable information (PII). While the world has made progress against COVID-19, developing a vaccine, producing it en masse, and rolling out vaccinations for millions worldwide, attackers evolved with each development with new and improved impersonation designs and email subject lines.

At the start of the pandemic, we found multiple social engineering schemes of CDC and WHO impersonators. Instead of receiving COVID spread distribution maps, victims received downloads of malware or a redirect to a malicious domain that attempted to harvest credentials. The graphic below outlines the sudden spike in new domain registration with “COVID” in the domain name.

In the late summer and fall, attackers largely pivoted from impersonating the WHO and CDC to impersonating COVID vaccine suppliers and distribution partners in their phishing schemes. In one instance, a threat actor campaign reported on by IBM X-Force successfully impersonated a recognized cold-distribution partner of the COVID-19 vaccine, targeting a wide variety of organizations from government agencies to energy, manufacturing, software, and internet security solutions sectors.

Later on, cybercriminals realized there was profit to be made in defrauding government COVID-relief programs and unemployment insurance benefits. They applied both direct and indirect approaches to fraud by applying to legitimate relief programs as fake personas and impersonating government entities, and reaching out to individuals via phishing campaigns to harvest their PII and then turnaround and reap the benefits.

Read more in our previous posting Targets And Predictions For The COVID-19 Threat Landscape.

COVID-19 Vaccination Scams

Widespread distribution of the vaccine began at the start of 2021, with many eager to find a shortcut or ‘skip the line’ for antibodies. “Vaccine” became the new subject line buzzword as cybercriminals organized phishing campaigns claiming they are authorized government pages for signing up for a vaccine appointment or a vaccine distribution waitlist for canceled legitimate appointments. The redirect web pages and sign-up forms were, of course, harvesting PII or other potentially lucrative personal information.

In addition to vaccination-related phishing, dark web posting around the newly released COVID-19 vaccine soared in January and February 2021, with many dark marketplace posts claiming they had vaccine doses for sale to the highest bidder. Like all black marketplace goods, these “vaccinations” are of dubious origin and may be vials of saline water. Still, this has not stopped orders ranging from tens to hundreds of USD for a single “dose.”

Read more on COVID relief and vaccinations scams in Targets and Predictions for the COVID-19 Threat Landscape.

Predictions for COVID-19 Cybersecurity Concerns in 2021

The return to normalcy we’ve heard about seems more and more a reality as medical experts and public health officials give sunny predictions about outdoor concerts this coming July and increasing freedoms around social gatherings and indoor dining. According to these experts, the post-COVID world (hopefully) looks a lot more like the pre-COVID one. Still, many organizational scientists and business leaders predict that remote working is not going to go away. Many companies have agreed to permanent hybrid work-from-home arrangements— meaning an expanded attack surface, vulnerabilities on related tools such as RDPs and VPNs, and advanced social engineering and phishing campaigns targeting employees who spend most of their time online will be constant. As new developments in vaccine distribution and newsbreaks about COVID-19 variants occur, threat actors will surely leverage employee fear, uncertainty, and doubt (FUD) to gain access to proprietary, confidential, and sensitive data as well.

Given these preconditions, Digital Shadows (now ReliaQuest) will continue monitoring the development in threat actor activity leveraging COVID-19 as emerging events will force cybercriminals to adapt their tradecraft. In the meantime, we’ve compiled an extensive list of threat intelligence resources about cyber threats related to the COVID-19 pandemic to help you navigate these challenging times.

Digital Shadows (now ReliaQuest)’ SearchLight™ maintains a threat intelligence library of 400+ threat actors, events campaigns, and TTPs so that security teams can stay informed and act proactively against threat actors targeting their industry and geographies. If you’d like to access the library for yourself, you can sign up for a test drive of SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) here.