Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

4/20/2020
04:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Stimulus Payments Are Popular Leverage for Cyberattacks

More than 4,300 domains related to stimulus and relief packages, many of them malicious, have been registered since January.

Global governments have responded to the coronavirus crisis with stimulus payments intended to help people and businesses. As these Economic Impact Payments roll out across the United States, criminals are launching malicious domains and phishing campaigns to target recipients.

Attackers have been trying to cash in on the COVID-19 pandemic since it started. Nearly one-fifth of phishing emails identified on the Gmail platform include coronavirus or COVID-19 in their content, Google reports. In the week of April 6 to 13, it found roughly 18 million emails were rejected per day because they preyed on crisis-related concerns. These use fear or monetary incentives to trick victims and often pretend to be government agencies or credible NGOs.

Now, instead of preying on virus-related fears, cybercriminals are targeting stimulus payouts. A total of 4,305 domains related to new stimulus or relief packages have been registered since January, Check Point researchers report. This includes 2,081 new domains registered in March; of these, 38 were malicious and 583 were suspicious. In the first week of April, 473 new domains were registered; of these, 18 were malicious and 73 were suspicious. Researchers saw a big spike in registrations starting March 16, when the government proposed the stimulus package.

Emails containing malicious attachments were sent with subjects related to the stimulus. One read "RE: UN COVID-19 Stimulus" and distributed the AgentTesla malware. Another read "COVID-19 Payment" and distributed the Zeus Sphinx Trojan. These emails held links directing the recipient to a phishing login page, where the final payload was delivered.

Ninety-four percent of coronavirus-related attacks Check Point saw over the past two weeks were phishing attacks. Three percent were mobile attacks conducted via dedicated mobile malware or via malicious activity carried out on a mobile device. The overall number of cyberattacks has spiked to an average of 14,000 per day over the past two weeks, researchers report, which is six times the average number of daily attacks when compared with the two weeks prior. In the week starting April 7, 2020, the average number of daily attacks jumped to 20,000.

While the Check Point team has seen an increase in the number of stimulus-related domains, it's worth noting they have also noticed growth in the number of coronavirus-related domains overall. Since April 2, nearly 17,000 coronavirus-related domains have been registered; 2% of these were found to be malicious and 21% were considered suspicious. In total, there have been 68,000 coronavirus-related domains registered since the outbreak started in January. 

"If you receive an email asking you to do something that a legitimate loan officer would never request – the transfer of money, the disclosure of PII/bank account/credit card information, etc. – then you should consider the email of a 'red flag-level,' highly suspicious nature," said Pondurance senior security analyst Chip Henderson in a blog post on stimulus scams. If an email from an unknown sender demands you to "immediately" view an attachment or click a link in exchange for financial gain, the best thing you and your employees can do is delete it, he said.

Check Point urges citizens to be aware of lookalike domains that claim to be related to the IRS or government agencies, and to watch for spelling errors in emails or websites. Employees should be careful when handling files from unknown senders and reviewing "special" offers, such as a cure for coronavirus or something similar. When ordering products online, they should avoid promotional links and instead Google the retailer to shop from the legitimate site.

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Cybersecurity Home-School: The Robot Project"

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/3/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4035
PUBLISHED: 2020-06-03
In WatermelonDB (NPM package "@nozbe/watermelondb") before versions 0.15.1 and 0.16.2, a maliciously crafted record ID can exploit a SQL Injection vulnerability in iOS adapter implementation and cause the app to delete all or selected records from the database, generally causing the app to...
CVE-2020-13783
PUBLISHED: 2020-06-03
D-Link DIR-865L Ax 1.20B01 Beta devices have Cleartext Storage of Sensitive Information.
CVE-2020-13784
PUBLISHED: 2020-06-03
D-Link DIR-865L Ax 1.20B01 Beta devices have a predictable seed in a Pseudo-Random Number Generator.
CVE-2020-13785
PUBLISHED: 2020-06-03
D-Link DIR-865L Ax 1.20B01 Beta devices have Inadequate Encryption Strength.
CVE-2020-13786
PUBLISHED: 2020-06-03
D-Link DIR-865L Ax 1.20B01 Beta devices allow CSRF.