Social Network For Security Executives: Help Make Right Cyber Security Decisions
Novel CoronaVirus is not only posing a grave danger in the real world, but it is also posing a threat to the cyberworld. Cybercriminals are exploiting the public fears about this deadly virus using phishing attacks.
Phishing is a technique used by cybercriminals to send genuine-looking emails and make the user take actions. These actions can be replying with personal information or clicking the link in the email and doing some transactions etc.
One such scenario is, a user receives an email impersonating as the Incometax department saying that he has a tax refund. He can transfer that refund to his account by clicking on the link that is provided in the email and just give the bank account and login details on the page. This page will look like the Incometax department's page, but it is not, and the user's details are compromised. Money is siphoned off from the bank using these details.
In the COVID-19 situation, many users receiving phishing emails impersonating as a software/antivirus company, saying that they are giving their software for free for work from home. This free software can contain malware or malicious software when installed and will infect the computer.
Some types of malware
Ransomware - Once infected, this malware can encrypt documents in the computer and demand a ransom in the form of Bitcoins to decrypt the files.
Keylogger – This malware can record whatever the user is typing, including the login credentials for a bank or an email account, and send it to the hacker.
Remote Access Trojan or RAT - This malware can give full remote access of the infected computer to a hacker. This hacker can watch what the user is browsing, or he can remotely activate the web camera and watch, or he can read the documents on the computer.
Zombies or bots - This malware even though it is harmless to the computer but controlled remotely to participate in the Distributed Denial of Service (DDOS) attacks to bring down the websites or networks.
Other examples of phishing emails based on COVID-19
· Email impersonating as HR of the company asking users to review the work from home policy, in the attached (malicious) word file.
· Email impersonating as HR that a colleague is tested COVID-19 positive and check the attached (malicious) document on how to keep safe from the virus.
· Email impersonating as the CEO of the company asking an employee to join in the video conference by clicking the link. This link can download malware.
· Email impersonating as the IT Help desk, asking the users to download and install the (malicious) VPN software for work from home.
· Email impersonating as the health department asking users to install (malicious) software on their mobile phones.
Tips to prevent yourself from being a victim to the phishing attacks