Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

4/20/2020
04:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Stimulus Payments Are Popular Leverage for Cyberattacks

More than 4,300 domains related to stimulus and relief packages, many of them malicious, have been registered since January.

Global governments have responded to the coronavirus crisis with stimulus payments intended to help people and businesses. As these Economic Impact Payments roll out across the United States, criminals are launching malicious domains and phishing campaigns to target recipients.

Attackers have been trying to cash in on the COVID-19 pandemic since it started. Nearly one-fifth of phishing emails identified on the Gmail platform include coronavirus or COVID-19 in their content, Google reports. In the week of April 6 to 13, it found roughly 18 million emails were rejected per day because they preyed on crisis-related concerns. These use fear or monetary incentives to trick victims and often pretend to be government agencies or credible NGOs.

Now, instead of preying on virus-related fears, cybercriminals are targeting stimulus payouts. A total of 4,305 domains related to new stimulus or relief packages have been registered since January, Check Point researchers report. This includes 2,081 new domains registered in March; of these, 38 were malicious and 583 were suspicious. In the first week of April, 473 new domains were registered; of these, 18 were malicious and 73 were suspicious. Researchers saw a big spike in registrations starting March 16, when the government proposed the stimulus package.

Emails containing malicious attachments were sent with subjects related to the stimulus. One read "RE: UN COVID-19 Stimulus" and distributed the AgentTesla malware. Another read "COVID-19 Payment" and distributed the Zeus Sphinx Trojan. These emails held links directing the recipient to a phishing login page, where the final payload was delivered.

Ninety-four percent of coronavirus-related attacks Check Point saw over the past two weeks were phishing attacks. Three percent were mobile attacks conducted via dedicated mobile malware or via malicious activity carried out on a mobile device. The overall number of cyberattacks has spiked to an average of 14,000 per day over the past two weeks, researchers report, which is six times the average number of daily attacks when compared with the two weeks prior. In the week starting April 7, 2020, the average number of daily attacks jumped to 20,000.

While the Check Point team has seen an increase in the number of stimulus-related domains, it's worth noting they have also noticed growth in the number of coronavirus-related domains overall. Since April 2, nearly 17,000 coronavirus-related domains have been registered; 2% of these were found to be malicious and 21% were considered suspicious. In total, there have been 68,000 coronavirus-related domains registered since the outbreak started in January. 

"If you receive an email asking you to do something that a legitimate loan officer would never request – the transfer of money, the disclosure of PII/bank account/credit card information, etc. – then you should consider the email of a 'red flag-level,' highly suspicious nature," said Pondurance senior security analyst Chip Henderson in a blog post on stimulus scams. If an email from an unknown sender demands you to "immediately" view an attachment or click a link in exchange for financial gain, the best thing you and your employees can do is delete it, he said.

Check Point urges citizens to be aware of lookalike domains that claim to be related to the IRS or government agencies, and to watch for spelling errors in emails or websites. Employees should be careful when handling files from unknown senders and reviewing "special" offers, such as a cure for coronavirus or something similar. When ordering products online, they should avoid promotional links and instead Google the retailer to shop from the legitimate site.

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Cybersecurity Home-School: The Robot Project"

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
'BootHole' Vulnerability Exposes Secure Boot Devices to Attack
Kelly Sheridan, Staff Editor, Dark Reading,  7/29/2020
Out-of-Date and Unsupported Cloud Workloads Continue as a Common Weakness
Robert Lemos, Contributing Writer,  7/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19453
PUBLISHED: 2020-08-03
Wowza Streaming Engine through 2019-11-28 allows XSS (issue 1 of 2).
CVE-2019-19455
PUBLISHED: 2020-08-03
Wowza Streaming Engine through 2019-11-28 has Insecure Permissions.
CVE-2020-4560
PUBLISHED: 2020-08-03
IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2019-4589
PUBLISHED: 2020-08-03
IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page is visible and accessible to a less privileged user. IBM X-Force ID: 167449.
CVE-2020-4328
PUBLISHED: 2020-08-03
IBM Financial Transaction Manager 3.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 177839.