Phishing Campaigns During COVID-19.

During the COVID19 pandemic number of phishing campaigns extremely increased.

Here are the most “popular” email subjects used in phishing campaigns in 2020:

1.     Password change/check required

2.     COVID-19 Awareness/News

3.     Vacation Policy Update

4.     Rescheduled meetings due to COVID-19

5.     Coronavirus Stimulus Checks

6.     Fedex Tracking

7.     Zoom: Restriction Notice Alert

8.     Jira: [JIRA] A task was assigned to you

9.     Your meeting attendees are waiting

10.  Microsoft: Abnormal log in activity on Microsoft account

11.  IT: ATTENTION: Security Violation

Hope you weren’t part of them! Enforce security awareness in your company!

Covid-19 Attacks: Healthcare Targets.

During the COVID-19 pandemic healthcare system became a favourite target for hackers, including research centres and educational institutions. The latest attack was observed in the University of California (San Francisco). University reported an attack without providing any details about affected structures.

Previously in March Canadian government health organization, engaged in the COVID-19 response, was targeted with an open-source ransomware.

In May the FBI and Cybersecurity and Infrastructure Security Agency reported an attack to U.S. research and healthcare institutions which are involved in COVID-19 vaccine trials.

Considering the increase of remote working during the pandemic, healthcare system became more vulnerable. Phishing is a number one attack vector. Also lack of established security policies and employees awareness trainings increases success of the conducted attacks.

New TrickBot update makes it harder to detect a malware.

Well known banking Trojan, TrickBot, got a new update which makes it harder to detect.

From 2016 this banking Trojan is continuously evolving.

It is commonly used to steal banking information and provide a backdoor access to the infected machine.

Also, it can operate as a botnet, sending the phishing emails with malicious attachments to help spread itself to additional machines and after that move around the network exploiting the EternalBlue vulnerability.

Recently researchers at Palo Alto Networks provided details regarding the latest Trickbot update which makes a detection harder.

New module, Nworm, was replacing Mworm, which makes sure that after infecting a machine no artifacts are left on it. In addition, Nworm is encrypted at transport. These features make malware detection harder.

Researchers said that to protect themselves users need to have an updated version of Microsoft Windows.

GitLab tested their employees with phishing emails.

Recently GitLab tested their employees with a phishing campaign. The goal of this test was to check security level of the remote working.

By using a domain name “gitlab.company” GitLab Red team created a phishing campaign with an open-source GoPhish and GSuite. The employees were asked to click on the link in the email and type their credentials on the fake login page.

More than 30% of company’s employees clicked on the link, 20% have submitted their credentials and only 12% reported observed attack to security team.

While this marks are less than average response, but still more that GitLab expected to see.