Covid related cybercrime dubbed "pandemic profiteering"
As the novel coronavirus, COVID-19, continues to spread across the globe, killing thousands and bringing the world to a standstill, criminal groups have seized on opportunities stemming from the pandemic to further their economic goals.
Dubbed by EUROPOL, the European Union Agency for Law Enforcement Cooperation, as ‘pandemic profiteering’, there has been a surge in COVID related cybercrime, including phishing and ransomware attacks and telephone fraud schemes, in recent weeks. The scams have mostly been constructed around the fraudulent sale of medical, sanitising and personal protective equipment.
Criminal exploitation of the COVID-19 outbreak
Cyber criminals and fraudsters are notoriously flexible and quick to react to new opportunities to increase revenue. The COVID-19 outbreak has led to increased demand for certain medical and sanitising supplies. This demand has been matched in a surge in counterfeit goods and ‘too good to be true’ purchasing opportunities that turn out to be fraudulent exploitation. Additionally, government social distancing measures has seen large portions of the workforce move to homeworking. This has led to employees using oftentimes less secure internet connections, relying increasingly on technology to carry out tasks. The criminal underworld has taken advantage of these developments, and the expectation is that this will continue over the coming months. Targets have varied from normal citizens to large companies and organisations.
In a recent report by EUROPOL, anecdotal cases are provided where companies have lost millions when attempting to purchase items from bogus sellers. One notable case includes a company in Singapore that reportedly spent 6.6 million euros on alcohol-based hand sanitising gels and facemasks that never arrived.
There has also been a reported increase in COVID related cybercrime during the ongoing crisis, especially in the form of phishing and malware attacks. The drastic surge in homeworkers, often using less-secure devices and internet connections, has provided cyber criminals with a larger pool of vulnerable targets. We have seen cases of criminals sending COVID-19-related emails as ‘click bait’, luring the recipients into opening links that require them to fill in sensitive personal information such as usernames, passwords or bank details. The content of these emails varies significantly, but can include exploitation requests for charitable donations to help tackle the COVID-19 outbreak, offers of financial support and access to bogus medical and sanitising equipment. These emails and adverts may also contain malware and lead to ransomware attacks. This is where, through clicking on the link or advertisement, the victim unknowingly infects their device with malware, which subsequently encrypts content on the device, after which a demand for ransom usually payable via crypto-currencies is made to decrypt the content.
Risk mitigation advice for COVID related cybercrime
The exploitation of the current situation by malicious actors will persist over the coming months and is likely to become more sophisticated. Both companies and their employees will need to adopt sensible precautions and that will present additional challenges at a time where the relationship is ‘remote’. Employers should take necessary steps not to compromise cyber security whilst instructing employees to work from home, and individuals should be wary of strange or unexpected COVID-19 emails in their mail inbox. Individuals should refrain from clicking on any suspect links in the bodies of these emails, and similar caution should be taken when viewing online advertisements about COVID-19 related products or services. Only official government directives and advice from licensed medical providers should be followed, and any financial support should be obtained through the official channels communicated by respective governments.
