Looking Ahead Cybersecurity and COVID-19 The unique circumstances wrought by COVID-19 continue to change and develop. Malicious cyber activities have been close on the heels of PHASE 3 related developments, demonstrating that threat actors are highly adroit CONVERGENCE APR – MAY 2020 at adapting their tactics to the evolving situation. In the months since the Targeting the “man-on-the-street” first appearance of the coronavirus, global cyber threats leveraging the COVID-19 pandemic have escalated in three distinct phases: Exploiting business disruptions and new norms PHASE 1 INCEPTION PHASE 2 — As more stringent stay-home orders came into EXPANSION effect at the start of the second quarter of 2020, threat actors started to utilise specially crafted JAN – FEB 2020 MAR – APR 2020 Capitalising on public fear and interest Growth of enterprise-centric attacks with new or broader attack surface Using COVID-19 to prey on insecurities and lure Amplifying the effectiveness and impact of service in Germany. A sophisticated threat services, websites of popular streaming platforms, potential victims — Phishing and watering-hole cyber incidents — Threat actors understand actor also reportedly set up a website and even government agencies. Individuals looking attacks were observed as threat actors used that crises and emergencies can significantly masquerading as the internal e-mail for financial relief, government aid or personal pandemic-themed lures to impersonate official intensify the impact of a cyber incident system of WHO to steal credentials from loans became targets of phishing campaigns. health authorities (e.g. World Health Organisation on critical infrastructure and sectors. The its members , while other threat actors As countries and citites gradually began relaxing (WHO)52) and spoof COVID-19-related information consequences of putting a fire brigade out of continued to capitalise on pandemic fears various restrictions and exiting lockdown, phishing feeds.53 Anxious and eager for information or action are not nearly as serious when there is to spread malware via “real-time” maps of lures quickly adapted to spoof official information advice during the initial outbreak, members of the no fire, as when there is. The healthcare sector, infection hotspots.58 sites and resources on easing measures. public were more likely to take the bait and follow which was incessantly spoofed by threat actors instructions of seemingly credible e-mails or text in Phase 1, now became a target itself. This messages that referenced the disease. It was also proved especially insidious given that malicious reported that the number of domain registrations cyber activities targeting frontline organisations Targeting new or broader attack surface (which started rising in mid-January) saw an battling COVID-19 not only target the personal — Many organisations implemented ad hoc additional spike in mid-February, which coincided details of patients, but also disrupt medical care systems and “work from home” arrangements with a large spike in COVID-19 cases — a possible and put human lives at stake. For example, there as the COVID-19 outbreak grew, to contain explanation being that threat actors picked up were reports of large-scale Distributed Denial- the spread of the virus while maintaining on the attack opportunities arising from the of-Service (DDoS) attacks targeting hospitals business continuity. These arrangements pandemic during this phase.54 in France55, ransomware attacks against the often rely on digital infrastructure to operate, Illinois public health agency in the USA, as well which expand the attack surface that threat as a major cyber-attack against Brno University actors can target. Cybersecurity firm Carbon Hospital in the Czech Republic. This phase also Black reported that ransomware attacks saw the launch of malicious cyber activities increased by 148 per cent between February against companies providing important services 2020 and April 2020, as the number of during this period, such as Ransom Denial- telecommuters increased by 70 per cent of-Service (RDoS) attacks on a food delivery during the same period.59 COVID-19 52 53 54 55 52 Ducklin, Paul. “Coronavirus ‘safety measures’ email is a phishing scam,” Naked Security by Sophos, 5 February 2020, https://nakedsecurity.sophos.com/2020/02/05/ coronavirus-safety-measures-email-is-a-phishing-scam/. Cao, Elliot, C. Chen, Joseph, Gamazo Sanchez, William, Wu, Lilang, and Xu, Ecular. “Operation Poisoned News: Hong Kong Users Targeted With Mobile Malware via Local News Links,” Trend Micro, 24 March 2020, https://blog.trendmicro.com/trendlabs-security-intelligence/operation-poisoned-news-hong-kong-users-targeted-withmobile-malware-via-local-news-links/. “Capitalizing on Coronavirus Panic, Threat Actors Target Victims Worldwide,” Insikt Group, 12 March 2020, https://www.recordedfuture.com/coronavirus-panic-exploit/. Fouquet, Helen. “Paris Hospitals Target of Failed Cyber-Attack, Authority Says,” Bloomberg, 24 March 2020, https://www.bloomberg.com/news/articles/2020-03-23/ paris-hospitals-target-of-failed-cyber-attack-authority-says. SINGAPORE CYBER LANDSCAPE 2019 phishing lures on homebound individuals to obtain credentials or to deliver malicious payloads. Phishing lures have been observed to masquerade as an ever-widening array of services — shipment delay notices, messages from courier 56 57 56 57 58 59 $ ERROR “DDoS Attack Targets German Food Delivery Service,” Dark Reading, 19 March 2020, https://www.darkreading.com/attacks-breaches/ddos-attack-targets-german-fooddelivery-service/d/d-id/1337359. Satter Raphael, Stubbs, Jack, and Bing Christopher. “Exclusive: Elite hackers target WHO as corona virus cyberattacks spike,” Reuters, 24 March 2020, https://www.reuters. com/article/us-health-coronavirus-who-hack-exclusive/exclusive-elite-hackers-target-who-as-coronavirus-cyberattacks-spike-idUSKBN21A3BN. “COVID-19, Info Stealer & the Map of Threats — Threat Analysis Report,” Reason Security, 9 March 2020, https://blog.reasonsecurity.com/2020/03/09/covid-19-infostealer-the-map-of-threats-threat-analysis-report/. Upatham, Patrick and Treinen, Jim. “Amid COVID-19, Global Orgs See A 148% Spike In Ransomware Attacks; Financial Industry Heavily Targeted,” VMWare Carbon Black, 15 April 2020, https://www.carbonblack.com/2020/04/15/amid-covid-19-global-orgs-see-a-148-spike-in-ransomware-attacks-finance-industry-heavily-targeted/. 53