Cyber Threats Are Heightened During COVID-19

While working from home can help slow the spread of the virus, it brings new challenges. As more and more of our clients are settling into work-at-home arrangements, they should be reminded that it is times like these when we are more vulnerable to phishing, ransomware, and a multitude of other security issues.

Over the last few weeks, it has been observed and reported that COVID-19 is being used by cybercriminals as a theme for phishing attempts. Threat actors are taking advantage of this opportune time to target organizations, businesses, and private citizens. Attackers will often use the branding of “trusted” organizations in these phishing attacks, especially the World Health Organization and the Centers for Disease Control and Prevention, in order to build credibility and get users to open attachments and click links.

Current COVID-19 Themed Attacks:

• On March 16, 2020, in the midst of responding to COVID-19, the U.S. Health and Human Services Department suffered a cyberattack on its computer systems.
• The U.S. Department of Health and Human Services, the Illinois Public Health District, and the Brno University Hospital in the Czech Republic have all been victims of cyberattacks.
• Coronavirus-themed phishing attacks and hacking campaigns are on the rise, including spear-phishing campaigns delivering malicious software and password harvesters through email.
• Campaigns targeting New Jersey state employees, including phishing emails, attempting to deliver the malicious software.
• Phishing emails appeared to come from the Centers for Disease Control and
• Prevention (CDC), using spoofed domains, including cdc-gov[.]org and cdcgov[.]org. This also includes phishing emails that appear to come from the World Health Organization (WHO).

We can guarantee, over time, that that attempts will only increase. We advise users to remain vigilant and exercise caution with all emails, especially those coronavirus-themed, social media posts, and websites.

The types of scams and attacks are growing more sophisticated. They require you to take extra precautions with email, text messages, phone calls, and the like. Examine every message carefully for red flags.

Some Reminders on Email Security:

• Does the sender appear to be someone you know, but with an unusual request?
• Is a company you do business with alerting you to some urgent issue you need to resolve promptly?
• Did you receive a vague message from another employee with an attachment you were not expecting?
• Is there a promise of financial reward or threat of financial repercussions if you do not act immediately?
• Be extra cautious when opening any attachments or clicking on any links within an email.
• If you receive a questionable email, never reply to the same email as a means of verification of authenticity.
• Verify emails that are suspicious by calling the sender with a known phone number.
• If you notice any suspicious activity, notify your IT Department or Help Desk immediately.
• When in doubt, verify everything.

Additional Security Tips for Working from Home

• Reset default Wi-Fi router passwords and ensure you are using WPA2 or WPA3 encryption.
• Avoid using public Wi-Fi.
• Limit your use of USB drives, unless they are encrypted. These devices are easily lost or misplaced, and that risk increases when working outside of your regular routine.
• Keep an eye on your laptop. Never leave it unattended, like in a vehicle.
• Keep your personal computers and other devices updated. This includes patching and ensuring your anti-virus or other security software is up to date and working properly.
• Do not send email or other documents to personal email addresses.
• Do not upload, copy, or otherwise transfer your company’s or clients’ data to any personal devices or personal cloud accounts.
• Only print documents when absolutely necessary and ensure they are properly destroyed when no longer needed.

If you have any additional questions or concerns about your risk of cyberattacks during the COVID-19 crisis, please contact Michael Aginsky, Chief Technology Officer of Gibbons and a member of the firm’s Privacy & Data Security Team.

To view all client alerts in Gibbons “The Coronavirus Pandemic and Your Business: How We Can Help” Series, click here. Please also be sure to follow Gibbons on LinkedIn for a continuous feed of COVID-19 related updates and other important business, industry, and firm news.