Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

4/20/2020
04:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Stimulus Payments Are Popular Leverage for Cyberattacks

More than 4,300 domains related to stimulus and relief packages, many of them malicious, have been registered since January.

Global governments have responded to the coronavirus crisis with stimulus payments intended to help people and businesses. As these Economic Impact Payments roll out across the United States, criminals are launching malicious domains and phishing campaigns to target recipients.

Attackers have been trying to cash in on the COVID-19 pandemic since it started. Nearly one-fifth of phishing emails identified on the Gmail platform include coronavirus or COVID-19 in their content, Google reports. In the week of April 6 to 13, it found roughly 18 million emails were rejected per day because they preyed on crisis-related concerns. These use fear or monetary incentives to trick victims and often pretend to be government agencies or credible NGOs.

Now, instead of preying on virus-related fears, cybercriminals are targeting stimulus payouts. A total of 4,305 domains related to new stimulus or relief packages have been registered since January, Check Point researchers report. This includes 2,081 new domains registered in March; of these, 38 were malicious and 583 were suspicious. In the first week of April, 473 new domains were registered; of these, 18 were malicious and 73 were suspicious. Researchers saw a big spike in registrations starting March 16, when the government proposed the stimulus package.

Emails containing malicious attachments were sent with subjects related to the stimulus. One read "RE: UN COVID-19 Stimulus" and distributed the AgentTesla malware. Another read "COVID-19 Payment" and distributed the Zeus Sphinx Trojan. These emails held links directing the recipient to a phishing login page, where the final payload was delivered.

Ninety-four percent of coronavirus-related attacks Check Point saw over the past two weeks were phishing attacks. Three percent were mobile attacks conducted via dedicated mobile malware or via malicious activity carried out on a mobile device. The overall number of cyberattacks has spiked to an average of 14,000 per day over the past two weeks, researchers report, which is six times the average number of daily attacks when compared with the two weeks prior. In the week starting April 7, 2020, the average number of daily attacks jumped to 20,000.

While the Check Point team has seen an increase in the number of stimulus-related domains, it's worth noting they have also noticed growth in the number of coronavirus-related domains overall. Since April 2, nearly 17,000 coronavirus-related domains have been registered; 2% of these were found to be malicious and 21% were considered suspicious. In total, there have been 68,000 coronavirus-related domains registered since the outbreak started in January. 

"If you receive an email asking you to do something that a legitimate loan officer would never request – the transfer of money, the disclosure of PII/bank account/credit card information, etc. – then you should consider the email of a 'red flag-level,' highly suspicious nature," said Pondurance senior security analyst Chip Henderson in a blog post on stimulus scams. If an email from an unknown sender demands you to "immediately" view an attachment or click a link in exchange for financial gain, the best thing you and your employees can do is delete it, he said.

Check Point urges citizens to be aware of lookalike domains that claim to be related to the IRS or government agencies, and to watch for spelling errors in emails or websites. Employees should be careful when handling files from unknown senders and reviewing "special" offers, such as a cure for coronavirus or something similar. When ordering products online, they should avoid promotional links and instead Google the retailer to shop from the legitimate site.

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Cybersecurity Home-School: The Robot Project"

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4719
PUBLISHED: 2020-09-24
The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.
CVE-2020-15604
PUBLISHED: 2020-09-24
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CW...
CVE-2020-24560
PUBLISHED: 2020-09-24
An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CW...
CVE-2020-25596
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. T...
CVE-2020-25597
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. Howeve...