Cybercriminals moved quickly to capitalize on the COVID-19 outbreak using malicious emails

While the COVID-19 outbreak has disrupted the lives and operations of many people and organizations, the pandemic failed to interrupt onslaught of malicious emails targeting people’s inboxes, according to an attack landscape update published by F-Secure.

Increase of malicious emails utilizing COVID-19 issues

Beginning in March and continuing through most of the spring, there was a significant increase of malicious emails utilizing various COVID-19 issues as a lure to manipulate users into exposing themselves to various email attacks and scams.

Common COVID-19-related campaigns included in these emails range from attempting to trick users into ordering face masks from phony websites to infecting themselves with malware by opening malicious attachments.

Three-quarters of attachments in these emails contained infostealers – a type of malware that steals sensitive information (such as passwords or other credentials) from an infected system.

“Cybercriminals don’t have many operational constraints, so they can quickly respond to breaking events and incorporate them into their campaigns. The earliest days of the COVID-19 outbreak left a lot of people confused or worried, and attackers predictably tried to prey on their anxieties,” said Calvin Gan, a manager with F-Secure’s Tactical Defense Unit.

“Spotting malicious emails isn’t typically a priority for busy employees, which is why attackers frequently attempt to trick them into compromising organizations.”

Additional trends from the first half of 2020

• Finance was the most frequently spoofed industry in phishing emails; Facebook was the most frequently spoofed company
• Email was the most popular way of spreading malware, and accounted for over half of all infection attempts
• Infostealers were the most common type of malware spread by attackers; Lokibot was the most common malware family
• Telnet and SSH were the most frequently scanned IP ports

The report also notes that attacks leveraging cloud-based email services are steadily increasing and highlights a significant spike in phishing emails that targeted Microsoft Office 365 users in April.

“Notifications from cloud services are normal and employees are accustomed to trusting them. Attackers taking advantage of that trust to compromise targets is perhaps the biggest challenge companies need to address when migrating to the cloud,” explained F-Secure Director of B2B Product Management Teemu Myllykangas.

“Securing inboxes in general is already a challenge, so companies should consider a multilayer security approach that combines protection technologies and employee education to reduce their exposure to email threats.”