The COVID-19 pandemic created a massive opportunity for cybercriminals, and they have been exploiting it with vigor, especially in phishing campaigns. Phishing is the use of deception to trick someone into performing an action. Social engineering techniques are used to get people to open malicious email attachments, visit hyperlinks to websites where sensitive information is harvested, or to take other actions such as make donations to fake charities.
In the early stages of the pandemic when little was known about the virus, how it was spread, the risk of infection, and the disease it caused, the public was very much in the dark and craved information. This created the perfect opportunity for cybercriminals for use in phishing and other cyberattacks.
Recently, the United Nations released data collected about phishing attacks involving COVID-19 related themes showing there had been a 350% increase in new phishing websites in the first quarter of the year, many of which were health-related and targeted health systems and hospitals.
Research conducted by Check Point also found a major rise in domain registrations linked to COVID-19. Research showed that phishing attacks increased from around 5,000 a week in February to more than 200,000 per week by late April, many of which were linked to COVID-19.
Early in the year the lack of knowledge about COVID-19 and the SARS-CoV-2 virus suited large-scale phishing campaigns involving millions of messages, with cybercriminals re-purposing their normal campaigns and started using COVID-19 themed websites and lures. Phishing emails offered information about the virus, possible cures, and advice to avoid being infected. When there was a shortage of personal protective equipment, phishing lures were used offering low cost supplies and testing kits.
Now that there is more information about the virus and cases and PPE shortages have largely been addressed, phishing scams related to COVID-19 have evolved. A study conducted by ProPrivacy showed that far from the COVID-19 related phishing attacks disappearing and cybercriminals returning to their old campaigns using fake invoices and alike, these campaigns are still running, but they have become more targeted and sophisticated.
These targeted campaigns offer answers to new questions being raised by the public, such as whether it is safe for children to return to schools. The study, conducted in partnership with VirusTotal and WHOIS XML, identified 1,200 COVID-related domains were still being registered each day and a sample of 600,000 of those domains revealed around 125,000 of them were malicious and were mostly being used for phishing.
We can expect to see another wave of phishing emails and websites set up related to COVID-19 vaccines when they start to come to market. Since the threat has not gone away and is likely to remain for some time to come, it is important to remain on your guard and to be cautious with any emails received, especially those related to COVIID-19.
Businesses also need to take extra care to ensure that their employees and devices are protected. Most businesses will already have a spam filtering solution in place to block phishing emails, but now is a good time to review those controls. If spam and phishing emails are still reaching inboxes, consider an alternative solution or a third-party spam filter if you are using Office 365 and are relying on Exchange Online Protection for spam and phishing protection.
One anti-phishing measure that is less commonly used by businesses is a web filter. A web filter allows businesses to control the websites and webpages that their employees can visit. Web filters, such as WebTitan, block access to websites known to be malicious, such as those known to be used for phishing. Web filters also categorize websites and allow certain categories to be blocked. By carefully controlling the web content that can be accessed by employees, businesses will be much better protected against phishing attacks and other cyber attacks with a web-based component.
It is also strongly recommended to implement 2-factor authentication, which will provide protection in the event of credentials being compromised in a phishing attack.
If you would like more information about web filtering, WebTitan, or improving your spam filter, give the TitanHQ team a call.