Covid-19 and Cyber Crimes

Since the outset of the COVID-19 pandemic cyber crimes have been increasing at a startling rate and have been the main method in which scammers have attempted to defraud individuals. However, such crimes are not only directed at people, but also at corporations and even countries. In these times of uncertainty and vulnerability, cyber criminals prey on weak systems and known vulnerabilities and even go hunting for valuable information via cyber espionage to steal knowledge, data, and intellectual property from others.

Threats against individuals

The current threats fall into four main categories:

  1. Phishing – a fraudulent attempt to obtain personal information such as usernames, passwords, and payment details by purporting to be a trustworthy recipient. The National Cyber Security Centre have detected more government branded schemes than any other subject for these types of scams during the pandemic.
  2. Malware distribution – emails sending out viruses of malicious code that are activated when a user clicks on a link, opens an attachment, or interacts in some other way with the message. There has been evidence of emails alleging to be from the World Health Organisation which have deployed Agent Tesla keylogger software on devices. TrickBot malware has also been commonly distributed downloading viruses and trojans.
  3. Registration of new domains – literally thousands of new website domains have been registered since the start of the pandemic that include COVID-19 related wording, many of which have been found to be either malicious or suspicious.
  4. Attacks against remote access or working infrastructures – this has increased vulnerability via Virtual Personal Networks, particularly where cyber criminals have exploited known weaknesses in remote working tools and software. The greater reliance since lockdown on remote banking and payment applications has also increased these risks.

Threats against organisations

Most vulnerabilities in information systems of organisations are due to poor or weak cyber security and the use of old operating systems or out of date antivirus software.

Ransomware attacks, particularly against health-related systems as previously seen in the WannaCry have also been feared during the pandemic. However, Microsoft reports that whereas there have been new cases against organisations, most attacks have been by groups who have previously accessed systems and lain dormant, waiting to release ransomware software when they felt the organisations were at their most vulnerable and therefore, more likely to pay. The spread of COVID-19 and the pressures this has put onto worldwide health systems have provided a perfect time for them to do this.

Global threats and cyber espionage

There have been reports that cyber criminals and organised crime groups, sometimes state-sponsored, have been targeting pharmaceutical companies, research organisations and universities looking for intelligence and sensitive data, including research on the COVID-19 virus and potential vaccines. On 5th May, the UK and US issued a joint advisory statement to international healthcare and medical research organisations advising staff to change any passwords that could be reasonably guessed due to evidence of large-scale ‘password’ spraying campaigns against such bodies. Although not named, countries involved in this are thought to include Russia, China, and Iran.

What to do to minimise your chances of being a cyber crime victim

Good cyber hygiene and the awareness of the threats is going to be the key to ensuring that systems are well protected. The NCSC provides detailed guidelines for staying Cyber Aware and safe for both individuals and businesses


Written by Researcher Janice Goldstraw-White

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.