This is assured by IBM Security X-Force, which identified a spoofing campaign with which it was intended to access privileged information in 14 countries. This was told by two investigators to El Espectador.
In December 2020 IBM Security X-Force, IBM’s business security research team, released research revealing that global COVID-19 vaccine cold chains are the new target for cybercriminals.
Experts uncovered a campaign based on fraudulent emails in which attackers posed as Haier Biomedical, a key vaccine supply company that claims to be the world’s most comprehensive cold chain supplier. With this facade they sent messages to all kinds of providers in order to obtain privileged information.
Last April, the team revealed that it found 50 additional files linked to emails addressed to 44 companies in 14 countries. El Espectador contacted Claire Zaboeva, senior cyber threat analyst at IBM Security X-Force and Melissa Frydrych, researcher at the same organization, who revealed details about these attacks.
When did you notice this attack? Was there a reason why it was not identified during the previous investigation?
Claire Zaboeva (CZ): This campaign started in September 2020 and was discovered by IBM Security X-Force in October. In December 2020, the initial investigation was released; However, this new discovery that we announced in January, and to the public in April, was about the discovery of 50 additional files that may have been linked to ‘spear phishing’ emails potentially targeting 44 other companies in 14 European countries, North America, South America, Africa and Asia We have continued to analyze the campaign after publication in order to provide a more comprehensive picture of the activity and share any news that may help members of the cold chain.
Also read: Cyber attacks on key sectors in the fight against COVID-19 are duplicated
What is spear phishing and how is it different from traditional phishing?
CZ: Traditional ‘phishing’ contains a general message and targets a large number of people, whereas ‘spear phishing’ is carefully crafted to target a specific person.
Exactly what was being asked for through this campaign? Enter malicious links? Sharing inside information?
Melissa Frydrych (MF): The update includes the key organizations that are likely targeting the transportation, warehousing, storage and distribution of vaccines. The attackers could be looking to infiltrate the extended supply chain of COVID-19 through ‘spear phishing’ to obtain information on aspects such as the transit of COVID-19 vaccines through various nations and territories; key technical requirements around storage, warehousing or transportation; key schedules for distribution; agreements that facilitate transit and trade, among other things.
Follow the news of El Espectador on Google NewsIn the report they mention that the emails were addressed to 44 companies in 14 countries, which are those countries?
MF: To clarify, we did not find 44 additional emails; Most of the new findings are html files containing email addresses that we suspect are connected to ‘spear phishing’ emails. Multiple industries in different countries may have been affected, including:
Transport: Italy, Korea, Japan, Colombia and the United States
Health: Czech Republic, Germany and the United States
Information and Electronic Technologies: Bulgaria, France, Poland, Ukraine and the United States
Have you been able to identify where the attacks are coming from? Whether it is a single organization or several cybercriminals acting independently?
MF: What we do know is that this campaign seemed to be very orchestrated and the actor will probably continue his efforts to achieve the goals associated with the vaccine’s cold chain. That is why we will continue to conduct research and publicize whatever we can to help raise awareness that members of the cold chain must remain vigilant.
It may interest you: Twitter will give 80% of the revenue from the “Ticketed Spaces” to the hosts
You mention a list of privileged information that attackers could be trying to infiltrate, what could be their purposes? Especially since it is a planned campaign even before the approval of vaccines in the world.
CZ: While we don’t know exactly what these threat actors were pursuing, we assessed that they were trying to pre-position themselves within the emerging global infrastructure of the COVID-19 vaccine cold chains. They could be looking to do a number of things with these attacks, from obtaining information about Advanced Market Commitments, as countries struggle to gain access to life-saving and economic vaccines, to stealing intellectual property to learn about technical requirements for the storage and transportation of vaccines, and even safe processes for distribution. Likewise, the attackers could be looking to carry out a disruptive or destructive attack, to impact the distribution of the vaccine.
Should the workers of companies in these industries have different practices than the average user should have on the internet? How can you identify these threats early?
MF: Trust but verify. Now is the time to scrutinize everything from the allies. To pick up the phone and call them to confirm that the unsolicited emails or attachments are really from them. Limit employee access to sensitive information. Only give access to those who need it for their roles. Use multi-factor authentication (MFA) throughout the organization. This is an extra layer of defense that prevents a bad actor from gaining access even if they have successfully obtained usernames, emails and passwords. Review the security of the website before sending or entering sensitive information, for example, wondering does the URL start with HTTPS indicating that the connection is encrypted?
Were the attacks successful or were they stopped in time? What damage was done?
CZ: Unfortunately, we have no visibility into the second stage of these attacks.
Once the attacks have been identified, how is the notification process of these types of threats from IBM to the affected companies?
MF: We work closely with a liaison to deliver information to appropriate organizations, such as CERT, and other foreign partners, following our responsible disclosure policy.
