As the world navigates postpandemic life, cybercriminals are continuing to evolve and shift their priorities and targets. At the start of the pandemic, it was remote work, then as the world has reopened, attacks against the supply chain and operations environments became more disruptive, plus ransomware evolved as the most prolific threat. In fact, according to The 2021 Ransomware Survey Report by Fortinet, more than two-thirds of organisations have been the target of at least one ransomware attack this year. So, the question is: what’s next?
Targeting vaccine passports
The next phase of the battle against Covid-19 includes proof of vaccination. Because of this, opportunistic cybercriminals have begun selling counterfeit vaccine passports on the black market. While this is not necessarily new, unlike other criminal activities, this strategy is going mainstream. FortiGuard Labs, Fortinet’s threat intelligence platform and research organisation, has begun to encounter offers of fake vaccine passports as lures in email scams. Successfully enticing the general population to open a malicious email attachment with the promise of receiving an illegal product may be a first. It reflects how polarising the issue of proof of vaccination is and why cybercriminals think that they can successfully exploit it.
FortiGuard Labs has also found various markets on the dark web offering fake vaccine passports. As expected, a wide range of products and services are available, from blank vaccine cards to verifiable passports that can be checked against legitimate vaccine databases worldwide.
It’s a prime example of criminals who are taking advantage of the current opportunities through these broad spam and phishing campaigns to not only target the general public but professionals as well. Cybercriminals are not only requesting bitcoin payments and personally identifiable information (PII) but are also using official-looking email communications from government organisations to trick people into believing their legitimacy. Demand for fake vaccine passports is growing due to the large population of unvaccinated people who want to avoid restrictions. Without missing a beat, email scammers and black-market criminals have acted on this demand.
The importance of training
Because these criminals are using phishing techniques to socially engineer and lure victims into a trap, it’s vital to address these challenges. These attackers have shown immense agility to pivot to the latest vulnerability, therefore training employees must also be as agile and proactive.
Organisations need to conduct ongoing training designed to educate and inform personnel about the latest phishing and spear phishing – phishing that is targeted at specific individuals or groups within an organisation – techniques and how to spot and respond to them. This should include encouraging employees to never open attachments from someone they don’t know and always treat emails from unrecognised/untrusted senders with caution. Fortinet has recently pledged to train one million people and offers free cyber security training and certification to customers, partners and employees.
Since many phishing and spear phishing attacks are being delivered as part of social engineering distribution mechanisms, end users within an organisation must also be made aware of the various types of attacks currently in use. This can be accomplished through regular training sessions and impromptu tests using predetermined templates originating from an organisation’s internal security department. Simple user awareness training on how to spot emails with malicious attachments or links can also help prevent initial access into the network.
Businesses must also look to a secure email gateway with advanced detection and response technologies as an effective way to fight against these attacks.
The threat landscape is constantly evolving and the rate of change has only accelerated now that the world is reopening. Attackers are looking towards the path of least resistance and capitalising on divisiveness to exploit money from individuals and potentially larger businesses. With the right training and education platforms alongside effective solutions, businesses can be confident that their workers don’t fall prey to the latest threats and scams. ●
Paul Anderson is director, UK and Ireland at Fortinet
Related
