Beware of COVID-19 Themed Fraud and Phishing Attacks
Social distancing and thorough hand washing aren’t the only things you should be practicing during the current COVID-19 pandemic. Fraudulent posts on social media and phishing attacks are on the rise, and they’re not easily identifiable at first glance.
What exactly is going on?
Phishing emails and themed ransomware attacks are masquerading as the WHO, CDC or the HHS in an attempt to lure people into visiting malicious websites, providing personal information, stealing login credentials or accept donations.
Some phishing attempts are as simple as trying to portray as a legitimate online web store, but once you click through they may attempt to steal credentials. Sometimes there is also a risk for the attacker to place ransomware on the computer, locking the user out of the system.
Source: https://blog.knowbe4.com/exploiting-the-coronavirus-the-spammers-the-scammers-and-the-bad-guys
Other styles of phishing pretend to be from the Dept of Health and Human services, and even seemingly will bring you to the hhs.gov website at first glance. However on closer inspection we see that the URL redirects you to a malicious website instead.
This example takes it up a notch and is randomly sent to a person’s cell phone as a text message, with the goal of luring them to receive free supplies.
More targeted attacks may be pretending to be from an internal person at a company, or a specific department utilizing vague and generic phrasing. Attackers are taking advantage of organizations implementing new rapidly changing policies surrounding COVID-19 that need to be understood by their staff in an urgent fashion.
The attachment in this example leads the victim to a website that attempts to steal Office 365 credentials.
Source: https://blog.knowbe4.com/extreme-measures-the-epidemic-of-covid-19-phishing-emails-rages-on
Where can I report fraud?
The federal government is aware these attacks, and has posted several resources online as well. The Dept of Justice has a page with information on how to report fraudulent emails, along with the Cybersecurity and Infrastructure Security Agency’s page with further reading.
What can be done to help protect my employees and my business?
We offer employee training, along with various mitigation methods to help keep these attackers from being successful and damaging your business. The average industry estimate for a ransomware attack is $713,000 per incident which includes downtime, lost revenue, legal fees and more. (Not to mention if you paid the attacker the ransom, that constitutes a federal charge of money laundering!)
If you are interested in having a risk assessment performed and an action plan put in place, we’re available to help. You can use the contact form below, or give us a call at (833) 733-2587.