The rapid shift in the current coronavirus crisis has led to a significant proportion of office-based employees now working from home remotely, which opens up threats related to expanded network access. While this would present cybersecurity challenges under ordinary circumstances, in the current climate there are additional aspects to consider. Cybercriminals are intentionally targeting people during this trying time, tapping into fear and confusion. Don’t fall victim to such exploitation; find out how to protect yourself from phishing attacks during the coronavirus outbreak.

How cybercriminals are exploiting coronavirus

Experts at the National Cyber Security Centre (NCSC) – part of GCHQ – have discovered that cyber criminals across the world are using the coronavirus crisis as a means of exploitation, to conduct online scams and malware attacks. Paul Chichester, NCSC Director of Operations commented;

“We know that cyber criminals are opportunistic and will look to exploit people’s fears, and this has undoubtedly been the case with the Coronavirus outbreak.”

Knowing the general public feeling is uncertain and fearful, cybercriminals are using this to design specific attacks that feed into this. This could be by using social media to post links and ads for bogus ‘anti-virus advice’, or sending out emails and ads with false ‘new updates’ and links to unsolicited websites.

To illustrate just how frequent these instances seem to be, cybersecurity firm Check Point have released findings that since January 2020, 4,000 new domains have been registered which are centred on coronavirus. They’ve found that around 3% of these domains are malicious, and an additional 5% are suspicious.

Real examples of COVID-19 related cybercrime

Some examples of recent cybercrime activity that’s based on coronavirus has included:

• Criminals fraudulently sent out emails posing as members of the World Health Organisation (WHO). The emails contained a malicious link and/or attachment, and some asked readers to submit sensitive information.
• Cybercriminals set up a false website under the US Center for Disease Control (CDC), on which they requested bitcoin donations for funding a coronavirus vaccination.
• Phishing emails have been sent out in the UK which contain attachments that detail – false – anti-coronavirus advice and defences. The attachments are infected with a malicious virus.

The different kinds of attacks are designed to do various things, from stealing money to stealing information. Examples include:

• Phishing emails. Cyber criminals invest time in creating emails that look genuine, such as from a health service, bank, or trusted company. The email will request you input personal information, which the criminal can then use for fraudulent activity.
• Ransomware infections. These can happen when a user clicks on a link, which could either be on an email, website, advert, or social media post. When the link is clicked, a virus is released and the user must pay a monetary ransom fee to recover their data.
• Sale of goods. Especially relevant at this time, some cybercriminals advertise goods that are either bogus or non-existent. This could be a “medically-trusted anti-COVID-19 mask”, or anti-coronavirus medication.

How to recognise and protect yourself against cybercrime

In any sector, businesses that have staff working remotely need to ensure that their employees know what to look out for when it comes to cybercrime. A solid human firewall is essential in order to limit the possibility of cyber criminals’ infiltrating your company’s data. There are various things that staff should know to look out for.

Spotting a Phishing Email

Phishing emails can be difficult to spot because they are usually created by experts, and are often excellent reproductions of genuine emails. In the event that an unexpected email arrives in your inbox, carefully check over the format and spelling to identify tell-tale mistakes.

Recognising a malicious link

Whether a malicious link was displayed on an email, advert, or website, it should be possible to identify it’s trustworthiness quickly. This is because they will have been put in place in order to obtain personal data, or to request payment for something.

Detecting ingenuine products

Many cybercriminals will distribute adverts for products which have bold claims, such as, at the moment, anti-coronavirus medication and equipment. Remember, if it seems to good to be true – it probably is.

The best piece of advice regarding cybercrime during the coronavirus outbreak – and indeed anytime – is to second guess anything you were not expecting. Whether this is a product, service, or information – do your own research to find out if what you are reading is true. Good practice is to seek information and products from a reputable source, such as official government or health service websites.

Protecting remote workers from cybercrime

Throughout the current situation, measures put into place to protect the public from COVID-19 include strict social distancing and lockdowns of services. The advice is to work from home if it’s possible, and at this time it is not known how long such measures will last. Because of this, business-owners and managers are advised to plan for the long haul, and assume that the majority of staff who are remote working will continue to do so for the foreseeable future.

To protect workers and consequently your business from cybercrime at this time, put the following into place:

• Supply information to employees about cybercrime during the coronavirus outbreak, including about any ongoing attacks as you hear of them
• Distribute cybercrime training materials to staff, and/or hold a group webinar to go over some of the key factors
• If employees will be accessing your servers remotely, make sure their devices are protected with the necessary anti-virus software

The speed with which the coronavirus has spread across the globe in the past months has led to a truly unprecedented period of confusion and uncertainty among individuals and businesses. As a huge proportion of businesses have been negatively affected, it is natural that right now, the owners of these companies will be more concerned with their current bottom line than other areas such as cybercrime. While this is of course a necessity, it is also important to give some consideration to the security of your company data. If cybercriminals do manage to breach your systems, the financial impact of this could mean even further difficulties at an already extremely trying time.