Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Don’t Panic: COVID-19 Cyber Threats

Summary: Unit 42 reported that attackers adapted to the COVID-19 pandemic by using virus-themed phishing emails to deliver RATs such as NetWire, NanoCore and LokiBot, ransomware including EDA2, and info stealers such as AgentTesla, targeting government healthcare organizations, medical research universities, industrial manufacturing firms and research institutes. Between January 1 and March 31, 2020, researchers identified 116,357 newly registered coronavirus-related domains, of which 2,022 were classified as malicious and more than 40,000 as high-risk, with a 569% growth in malicious domain registrations from February 1 to March 31.

Bottom line: Unit 42 observed emails from a spoofed noreply@who[.]int address carrying a malicious RTF lure sent to a Canadian government health organization working on COVID-19 response and a Canadian university conducting COVID-19 research, exploiting the known Microsoft vulnerability CVE-2012-0158 to deliver EDA2 ransomware.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related