Key Findings
- A change in consumer behavior witnessed that included increased personal device usage, visits to risky apps and websites, and increased sharing of managed devices.
- Cyber criminals have leveraged information relating to the COVID-19 pandemic to shift the way they employ traditional tactics, techniques, and procedures (TTPs) like phishing, ransomware, and malware.
- The COVID crisis has prompted companies to invest in automation and robotics to manage operations better, with COVID-19 as the tipping point for intelligent automation of work while also often facing declining revenue related to the pandemic.
Analysis
Increased personal use of managed devices exposes the organization to malicious content.
The use of managed devices for personal use has grown since the beginning of the COVID-19 pandemic, heightening organizations' exposure to malicious content.
Netskope reports that the number of people working remotely doubled and that browsing to websites and applications with potentially malicious content has tripled.
The lines between personal/professional use further dimmish as users share devices within their household, very likely caused by supporting remote learning at home. In the pandemic period, online education has risen to 4.5x at the beginning of the school year. Also, websites categorized as "Personal Sites & Blogs" served the most malicious content.
Shift in the tactics to exploit COVID-19 themed attacks.
Bitdefender reported (PDF) that cybercriminals strongly invested in phishing, ransomware, and commodity malware during the pandemic. The pandemic has changed the working style across the globe by adopting the new normal 'work-from-home', helping attackers to improve their tactics and techniques. In the last six months, Bitdefender categorized about 40% of COVID-19-themed emails as spam.
Following the shift toward remote working, actors began exploiting home routers, IoT devices, and video conferencing applications. The Bitdefender report corroborates earlier findings that most actors are financially motivated, act opportunistically, and continuously adjust their messaging based on how the infection developed regionally.
EclecticIQ analysts assess with high confidence that the recent resurgence of COVID-19 cases in Europe and other parts of the world will spur new COVID-19 related phishing and fraud campaigns.
Artificial Intelligence and Automation: Current and Post-COVID-19 impact.
Due to employees' unavailability during a pandemic situation, Artificial Intelligence has played a crucial role in the health sector during the COVID-19 period.
The global response to managing the COVID-19 pandemic is defined by implementing social distancing strategies and decreasing human interference.
Hence, to reduce human contact, several AI applications has been developed, helping track, recognize, and report the virus's spread.
Positive results may present AI technologies in a new light, showing how it can assist in improving our day-to-day lives.
Although AI has a positive impact on the health sector, it could aid attacker TTPs by enabling certain attack vectors, increasing the attack surface, and/or assisting with obfuscation.
As Europe’s leading cyber threat intelligence company, we at EclecticIQ have decided to make use of our resources and provide the community with custom reports on threats connected to the COVID-19 pandemic throughout the duration of the crisis. This is the 26th report in a weekly series of updates to inform of important developments to COVID-19-themed attacks.
