Phillip Larbey, managing principal for Europe, Middle East and Africa at Verizon Enterprise Solutions, describes how cyber criminals have adapted to the COVID-19 world.
Since we launched the Verizon Business 2020 Data Breach Investigations Report (2020 DBIR) in May 2020, we have seen the COVID-19 pandemic deliver additional security challenges to businesses around the globe.
We have seen organizations quickly move their work-forces en-mass to remote working. E-commerce has increased, with many industries, and especially retail and food services, now relying more heavily on their online presence and cloud-based workflows. And health providers have also moved to online service delivery. These are just a few industries the pandemic has impacted.
Unfortunately, in these times of rapid change and confusion, cyber-criminals have been watching and looking to capitalize on any opportunity for financial gain. In order to shed light on the increasing number of threat actors worrying cyber security specialists, our data breach investigation team has generated a three-month analysis. It's called “Analysing the COVID-19 data breach landscape” and it brings these threats under the spotlight.
Unlike our DBIR series, this study focuses on 36 confirmed data breaches which were identified as being related directly to the COVID-19 pandemic, and also reviews 474 data breach incidents from March to June 2020 based on contributor data and publicly disclosed incidents.
We have combined this data with our own team’s observations drawn from our collective years of experience to ascertain the cyber-trends that have most impacted businesses during this time.
A focus on well established hacking techniques
Criminals are focusing on the tried and tested amidst the confusion. Before COVID-19, cyber-criminals were successfully using tried and tested methods to obtain data. It goes without saying that if these tactics worked in a stable business environment, they have been working even better in an era of unprecedented disruption.
Criminals are ultimately lazy in their approaches and, faced with a larger attack surface than usual during the pandemic, there has been no need for them to invent new attack strategies to achieve their goals.
Based on our observations we have seen the use of these common threat actors increase:
Taking advantage of human error
Human error is often seen as a major cause of security incidents. In fact we reported that nearly a quarter of the breaches analysed in our 2020 DBIR were due to this. Faced with major disruption, increased workloads as a result of decreased workforces, and of course, for many, the distraction of in-house family members and home-schooling, there is no wonder that more errors have been reported during the pandemic.
Focus on stolen credential-related hacking
Our 2020 DBIR flagged that over 80 percent of breaches were caused by stolen or brute-forced credentials. This has now been exacerbated by the large number of employees working from home requiring ongoing remote access and workstation maintenance. Business IT departments are being challenged to secure company assets on the corporate network while the majority of the workforce is out of the office. This has widened the number of remote targets for cybercriminals to target.
Use of ransomware is spiking
We saw that several incidents reviewed within the COVID-19 dataset involved the use of ransomware. These involved the copying and posting of data (either partially or entirely) publicly online. Of the nine malware incidents in the COVID-19 dataset, seven were confirmed breaches demonstrating a spike in ransomware usage.
Phishing emails play on emotions
Phishing has always been a popular cyber-crime tactic. Prior to COVID-19 we flagged that credential theft and social attacks such as phishing and business email compromises were at the root of the majority of breaches (over 67 percent).
Combine this attack success with uncertainty, fear and the need for COVID-19 information, then you will understand why phishing emails containing the words "COVID" or "CORONAVIRUS, “masks”, "test”, "quarantine" and "vaccine” were found to be widely used within this time period.
We saw phishing emails unrelated to COVID-19 had a slightly lower click rate (with a median of 3.1 percent). The phishing emails that were linked to COVID-19 had a somewhat higher median at 4.1 percent and showed more organizations having far higher click rates - over 50 percent in some cases.
A phishing simulation performed on approximately 16,000 people in late March (the early weeks of shelter-in-place for many states in the USA) found that almost three times as many people not only clicked on the phishing link, but also provided their credentials to the simulated login page than in pre-COVID-19 tests late last year. This heightened emotional response is completely understandable when COVID-19-related terms are involved and are being exploited by cyber-criminals.
Comprehensive security strategies needed
Comprehensive security strategies can help steer in these unchartered waters. Businesses around the globe have continued to focus on serving their employees and customers as a priority throughout the pandemic.
We must arm ourselves with insights into the evolving tactics used by cyber-criminals during this period and use comprehensive security strategies - such as managed security services, identity solutions and most importantly on-going employee education. By taking this approach we can set a more productive course to help create a more secure business environment and maintain business momentum.
Main image courtesy of iStockPhoto.com