100 Days of COVID-19: Mimecast Threat Intelligence

The global spread of COVID-19 has created many new opportunities for threat actors in malware, impersonation attacks, and email phishing, forcing all organisations to carefully review their multi-layered cybersecurity strategies and arm employees with knowledge of how to protect themselves. Increases in coronavirus-related spam and impersonation attack campaigns are exploiting the vulnerability of users working at home, taking advantage of their desire for information about the coronavirus pandemic to entice them to click on unsafe links. Traditional fraudsters are also using spam to offer fake or non-existent goods such as protective masks or COVID-19 cures. To provide a clear picture of how malicious actors are exploiting those opportunities, the Mimecast Threat Intelligence team analysed key trends in activity over the first 100 days of the pandemic – from January to the end of March 2020. The monthly volume of all detection categories reviewed increased significantly – by 33% – during this period:Spam/opportunistic detections (increased by 26.3%)Impersonation detections (increased by 30.3%)Malware detections (increased by 35.16%)Blocking of URL clicks (increased by 55.8%) Employees who are working at home for the first time may not be sufficiently aware of cyber threats. In fact, researchers found that employees from companies not using Mimecast Awareness Training were more than 5X more likely to click on malicious links than employees from companies that did utilise the training. The rise in unsafe clicks suggests an urgent need to refresh awareness training for employees and help them create a secure working environment. IT teams need to consider which communication services they want to sanction for secure work at home. Workers should not be sharing sensitive data over WhatsApp or personal email accounts and IT teams should be able to monitor and disable usage of unsanctioned applications. Cybersecurity training needs to be regular and frequent. Research has shown that to be most effective, training needs to be short, fun and engaging to help improve security culture.Mimecast Threat Intelligence has observed more than 60,000 COVID-19-related registered spoof domains since early January 2020. The Retail industry was the hardest hit, and researchers detail the proliferation of domain spoofing of major retail brand websites in attempts to steal from unsuspecting panic-buyers as they look to purchase necessities online. Given the efforts by governments to address the COVID-19 public health crisis, it is almost certain threat actors and criminals will continue to exploit this resulting confusion, and there will be an increase in the observed cyberattack methodologies against vulnerable targets. An Overview of Cyberthreats, January-March 2020In a typical year, there are moderate increases with a regular weekly fluctuation in detections with a discernible but gradual increase over time. In the first months of 2020, however, the volume of these detections increased from 103.7 million in January to more than 118.7 million by the end of March, reflecting a 28% increase in detections.Spam detections witnessed an exponential 26% increase. Mimecast blocked the delivery of more than 83 million COVID-19 related emails at the spam/opportunistic layer.Impersonation detections increased by 30%. These detections were the only category to continue to significantly increase during many later weeks when other categories experienced reductions, suggesting that threat actors placed greater focus on social engineering.Malware detections increased by 35% during the period of analysis.Blocked URL clicks increased by 55%. It’s important to note that threat actors’ efforts to exploit the COVID-19 pandemic use common vulnerabilities and behaviours: 1. Assets. Most organisations lack a complete view of their internet-facing assets. These assets comprise a large and complex attack surface that needs to be understood and actively managed to reduce the ‘low-hanging fruit’ available for cybercriminals to exploit. There are two potential contributors to this lack of visibility: shadow IT and vulnerabilities potentially resulting from mergers & acquisitions.2. Malware and ransomware. Emails often appear legitimate and may have an attachment, such as a pdf, document, zip file, video, or spreadsheet.Often, when the target clicks on the attachment to open it, malware is downloaded onto the target network.3. Managerial and policy implications. If there is no clear cyber resilience or mitigation culture within an organisation (or clear process for subcontracting and outsourcing to a third-party organisation), vulnerabilities may develop and be exploited. Such vulnerabilities could be discovered from social engineering or phishing campaigns. Weak governance compounds the problem of defending against cyberattacks and makes it difficult for organisations to co-operate with each other in defending against such attacks. Even unsophisticated attacks can succeed in this environment, demonstrating the importance of sharing techniques to enhance one’s partners’ abilities to identify, detect, or respond to threats.4. Machine to human interface. Human interaction is the common factor in each of these vulnerabilities. Whether it is following a link, not patching hardware or software, not creating a robust framework, humans are involved. In fact, it’s believed that human error and social engineering account for 90% of all breaches – not just those related to the global pandemic. By implementing a robust training process the presence of the human firewall will greatly add to a layered security strategy.The Bottom LineThe Mimecast Threat Intelligence team believes there will be an increase in threats against vulnerable targets during this time of significant uncertainty and instability. There are several significant but simple steps individuals and their employers can take to minimise risk and increase cyber awareness:For secure remote working, update home WiFi with a strong password. Never click on COVID-19 related attachments received outside your trusted perimeter. Double-check links – if suspicious, do not click! Do not use personal devices at home to access organisation networks, data, or emails.Organisations should review their policies and practices on cybersecurity – including increasing awareness training on the most common attack campaigns and encouraging IT/SOC teams to enforce unique password policies and to enable two-factor authentication wherever possible.

100 Days of COVID-19: Mimecast Threat Intelligence

Confirm cancellation

Sign up benefits