We hope that you, your family, your friends, and your business colleagues are all remaining safe during these unprecedented times. Beyond the serious health issues associated with COVID-19, the level of uncertainty that exists can also lead to panicked decisions and unstable business maneuvers. This is why we want to do what we can to shine a light on how coronavirus will present some security vulnerabilities for unprepared organizations.
Historically, global epidemics result in a rise of ransomware attacks, and coronavirus won’t be any different. Malicious actors are already utilizing the pandemic and ransomware as a way to spread malware to their victims.
Who is at Risk?
Many large organizations present the highest risk, especially those that have a strong reliance on global supply chains in highly affected regions of the world. Employees at organizations that fall into this category are likely paying very close attention to virus-related developments and news stories, which presents specific vulnerabilities in the area of social engineering.
Despite the increased risk for large organizations, any businesses that have team members keeping an eye on this pandemic are susceptible to ransomware attacks. Cybercriminals utilize social engineering in order to lure victims into the clicking of a link that releases malware and makes it possible for ransomware infections to spread. Ransomware then gains control of a computer system, blocking access until the victim pays money to the attacker in order to regain access.
Health organizations are also at high risk, as these potential targets are laser-focused on tracking the virus, seeking cures, and providing the public with timely information. If your organization is seeking information related to coronavirus, you should make sure that your team is hyper-aware of the security threats that exist.
Disasters and global epidemics present an opportunity for cybercriminals to exploit the heightened interest in disaster-related developments. Coronavirus is already leading to a continuation of this pattern.
Two Approaches to Spreading Ransomware
Now that we understand that these attacks are carried out through phishing campaigns, it is important to examine the approaches that will be utilized by malicious actors. There are two tools being utilized, AZORult malware and Emotet Trojan.
The first method, AZORult malware might sound familiar to those who are aware of the recent phishing campaign that targeted the shipping industry in January. This malware has been used since 2016 in order to deploy ransomware to unsuspecting victims. The ransomware steals ID/passwords, browsing history, cookies, and more. Additionally, it can act as a downloader of other forms of malware.
Emotet Trojan has already been spotted in Japan being used within emails claiming to provide information related to Covid-19. In reality, clicking on links within these emails activates Emotet, which can ambush your hardware and gain access to sensitive information.
It is so important to remain informed as this pandemic continues, as developments are being made every day and businesses of all sizes are being affected. This is why it is necessary that individuals at all levels of an organization understand that malicious actors are looking to exploit this information in order to carry out ransomware attacks. If one person at a company clicks a link that offers additional information, and that link results in a ransomware attack, the entire organization is at risk.
It is critical to remain vigilant and prepare your company for what might lie ahead. If you find yourself needing training or cybersecurity support for your team, please don’t hesitate to contact us today.