Cybercrime attacks during COVID-19

The COVID-19 pandemic and the measures to contain new infections with the SARS-CoV-2 virus have a good grip on our population. Schools, kindergartens and day-care centres are closed, and the leisure and tourism sectors have come to a complete standstill. Many people's futures are on the line despite government relief measures. At the same time, employees in jobs relevant for the system, mostly in jobs in the healthcare sector, are working with great commitment to ensure that everybody can be helped despite the large number of people who are ill. In order to slow down the spread of the disease and to support contact restrictions, workplaces throughout Germany have been moved to homes, wherever possible, and an end to this new working environment is not yet in sight.

Nevertheless, in addition to the strong solidarity among the people, there are criminal organisations and individual perpetrators who take advantage of this unusual and uncertain situation. For this purpose, they adapt tried and tested methods to the new situation and exploit both the insecurity of the people and the new decentralised structures. Such attacks have the potential to cause massive and lasting disruption to companies now and after this crisis.

The police have publicly warned of attackers and fraudsters; programmers of anti-virus software confirm this trend. Criminals are sending e.g. "phishing" emails, in which they sometimes purport to be representatives of public authorities, such as the public health department or the police, and request the recipients to follow links to fake websites or to download attachments with current information on the COVID-19 pandemic. However, not only do these documents contain no information, but they may install malware in the background, which at best only leads to more spam messages, but in the worst case captures passwords and allows the attacker access to your systems and data. A current malicious campaign e.g. uses a "corona card" as phishing bait, which is supposed to provide real-time, up-to-date figures on COVID-19 infections. If the card is opened, however, malware will be downloaded.

Media regularly report on the success of mobile phone apps to contain the pandemic, such as in Singapore or South Korea.

This is supported by recent studies of leading researchers on the modelling of epidemics. In Germany the first tests of such apps, which are in fact compliant with the General Data Protection Regulation (GDPR), have been completed with promising results.

But even this positive news is misused by attackers for their own purposes. Security researchers found an Android app purporting to show the latest figures on the spreading of the coronavirus. However, after its installation the app locked the devices and extorted their unlocking against a ransom payment. These cyber extortion attempts seem harmless in view of the fact that criminals do not even shy away from hospitals, as happened recently in the Czech Republic and several times last year in Germany.

To protect yourself from such attacks, you should observe the following rules

• Pay particular attention to the sender's email address, salutation, closing wording, spelling and grammar mistakes, or other generic characteristics.
• Do not open files, attachments or links from unknown senders.
• Be suspicious even if the e-mails are from seemingly official sources.
• Do not accept ransom payments if you have fallen victim to a ransomware attack.
• For up-to-date information on the infection, contact official authorities such as the federal or state governments and the Robert Koch Institute.

Should you have become the target of a cyber attack despite all caution, we assist you in these uncertain times with our cyber incident response, IT security, and IT forensic experts and answer your questions relating to data protection.

We are listed by the German Federal Office for Information Security [Bundesamt für Informationssicherheit] as a qualified APT response service provider.

• For more information on our qualification as APT response service provider follow this link.

• For more information on our qualification as APT response service provider follow this link.

Practice note

Affected businesses can reach Warth & Klein Grant Thornton by telephone 24/7 on our Incident Response Hotline +49 211 9524 8824.

Contact

Helmut Brechtken
Partner
T +49 211 9524 8576
E helmut.brechtken@wkgt.com

Chris Lichtenthäler
Manager
T +49 211 9524 8641
E chris.lichtenthaeler@wkgt.com