Mcafee Labs COVID-19 Threats Report, July 2020 REPORT KEY TOPIC
Total Page:16
File Type:pdf, Size:1020Kb
McAfee Labs COVID-19 Threats Report July 2020 REPORT This report was researched The dominant theme of 2020 has been the and written by: • Christiaan Beek scale and impact cyber-related attacks have • Taylor Dunton • Dan Flaherty had on our wider society. • Lynda Grindstaff • Steve Grobman Introduction • Tracy Holden • Tim Hux What a year so far. What started as a trickle of phishing campaigns and the occasional • Abhishek Karnik malicious app quickly turned into a deluge of thousands of malicious URLs and more-than- • Sriram P capable threat actors leveraging our thirst for more information as an entry mechanism • Tim Polzer into systems across the world. • Thomas Roccia In this “Special Edition” threat report we take a deeper dive into COVID-19 related attacks. • Raj Samani Additionally, we have launched the McAfee COVID-19 Threats Dashboard to complement • Sekhar Sarukkai this threat report and extend its impact beyond the publication date. • Craig Schmugar Timeliness is a challenge for publishing any threat report, but through the development of MVISION Insights, our threat reports will link to a live dashboard tracking the world’s top threats. We will also make available the IoCs, Yara rules, and mapping to the MITRE ATT&CK framework as part of our continuing commitment to sharing our actionable intelligence. I hope these McAfee resources will be useful to you, the reader. Follow Share 2 McAfee Labs COVID-19 Threats Report, July 2020 REPORT KEY TOPIC The dominant theme of 2020 has been the scale and impact cyber-related attacks have had on our wider society. All too often, we are called into investigations where businesses have been halted, or victims have lost considerable sums of money. While we all have had to contend with pandemic lockdown, criminals of all manner of capability have had a field day. We hope you enjoy these new threat report approaches, and moreover we would appreciate you sharing these findings far and wide. These tools and insights could be the difference between a business remaining operational or having to shut its doors at a time when we have enough challenges to contend with. Many thanks for your time. —Raj Samani, McAfee Fellow and Chief Scientist Twitter @Raj_Samani Follow Share 3 McAfee Labs COVID-19 Threats Report, July 2020 Table of Contents 6 COVID-19 Cyberthreat 32 Spams and Scams Timelines, Distribution, and Detection 33 Underground Marketplaces 7 Threats To Sectors and Vectors 35 URL Scams 10 Malware Threats 39 Recommendations Statistics 14 Threat Actors Target the Cloud 18 Malware Phishing and Trojans 30 Ransomware 4 McAfee Labs COVID-19 Threats Report, July 2020 REPORT KEY TOPIC It’s no surprise that opportunistic cybercriminals are attachment, and other engagements designed to targeting employees working from home during the unleash their full arsenal of malware with tactics and COVID-19 pandemic. The need for enterprises to quickly techniques honed to target pandemic vulnerabilities and quarantine workforces has challenged SOCs and CTOs breach internal corporate resources. to adapt a secure work-from-home model the scope of Since early reports of the Coronavirus, McAfee which the security industry has never experienced. researchers have focused our security research and Providing the collaboration and productivity systems resources on the tactics and techniques cybercriminals sufficient to fuel a functioning work-from-home force has have wielded during the pandemic’s progression. required a greater reliance on personal cyber hygiene as We have worked to keep our customers and security employees balance their everyday at-home bandwidth community safe through the monitoring and adaptation with the technical demands of their jobs. The workforce of our detection stack to better manage the COVID-19 is also distracted by the anxieties created by a departure threat landscape. Consult the McAfee Threat Center for from normalcy and routine, dealing with their family’s the latest in evolving COVID-19 threats. needs at a time when the requirements of quarantining such as social distancing, personal protection equipment requirements, supply-and-demand shortages, increasing unemployment, and a full stop on the mental benefits of expectations and routines. Cybercriminals see a remote, distracted, and vulnerable workforce as opportune targets. Cybercriminals are using COVID-19-themed ransomware, RDP exploits, scam URLs and spam designed to lure remote workers into mishandling external engagement. Clicking an unverified link or opening an ill-advised Follow Share 5 McAfee Labs COVID-19 Threats Report, July 2020 REPORT KEY TOPIC COVID-19 Cyberthreat Timelines, Distribution, and Detection Follow Share 6 McAfee Labs COVID-19 Threats Report, July 2020 REPORT KEY TOPIC Threats to Sectors and Vectors The volume of threats related to COVID-19 has been significant, with lures used in all manner of attacks. McAfee has observed malicious detections in almost all the countries impacted by the COVID-19 pandemic, although the volume differs greatly. Global Detection Heat Map The McAfee COVID-19 Threat Dashboard uses intelligence gathered and updated daily by McAfee Advanced Programs Group (APG). McAfee first observed a detection for known IoCs in mid-January. We observed detections in almost all the countries which have been impacted by the COVID-19 pandemic.¹ Follow Figure 1. Our COVID-19 Threats Dashboard extends the impact Share of this report with daily updated intelligence provided by McAfee Advanced Programs Group (APG). 7 McAfee Labs COVID-19 Threats Report, July 2020 REPORT KEY TOPIC ublcly Dsclose ecurty Icets y Reo Top 10 Tarete Coutres uber of reporte breaches 0 20 00 200 0 10 00 20 100 200 0 10 0 U.S. Multple A reat rta Italy race Ia Caaa pa eray Australa 100 0 0 Q4 1 2019 2020 2019 1 2020 orth Aerca Multple urope Asa Australa Source: McAfee Labs, 2020. Source: McAfee Labs, 2020. Figure 2. McAfee Labs counted 458 publicly disclosed security incidents Figure 3. Disclosed incidents targeting the United States in Q1 2020 in the first quarter of 2020, including those in which the region target increased 61%, Great Britain increased 55%, and Canada increased 50% was non-applicable, an increase of 41% from Q4 of 2019. Disclosed over the previous quarter. incidents targeting North America increased 60% over the previous quarter, while Europe decreased 7%. Follow Share 8 McAfee Labs COVID-19 Threats Report, July 2020 REPORT KEY TOPIC Top 10 Tarete Iustry ectors Top 10 Attac Vectors 100 22 90 200 0 1 0 10 0 12 0 100 0 75 0 20 0 10 2 Iual Multple Iustres ublc ealthcare ucato aceIsurace Maufactur Techoloy Retalholesale tertaet 0 0 Malare Account Hijacking Targeted Attack on Malicious Vulnerability DDo o Malare pa L Malicious Script Business Email Misconfiguration 2019 1 2020 2019 1 2020 Security incidents data is compiled by McAfee Labs from several sources. Security incidents data is compiled by McAfee Labs from several sources. Figure 4. Disclosed incidents detected in the first quarter of 2020 Figure 5. Overall, malware led disclosed attack vectors in the first targeting Multiple Industries increased 94%, the Public sector increased quarter of 2020, followed by account hijacking and targeted attacks. 73%, the Individual sector increased 59%, and Manufacturing increased Disclosed malware attacks increased by 33% from the previous quarter, 44%, while incidents in Science and Technical decreased 19%. account hijacking attacks increased by 71%, and Targeted Attacks increased by 60%. Follow Share 9 McAfee Labs COVID-19 Threats Report, July 2020 REPORT KEY TOPIC Malware Threats Statistics The first quarter of 2020 saw significant increases in Total Malare several threat categories: 1,0,000,000 1,200,000,000 ■ McAfee Labs observed 375 threats per minute in Q1 1,00,000,000 2020. 900,000,000 ■ New PowerShell Malware increased 689% in Q1 2020 0,000,000 when compared to the previous quarter. This increase 00,000,000 can largely be attributed to the Donoff family of 0,000,000 TrojanDownloader. Donoff also played a significant role 00,000,000 in a 412% increase of New Macro Malware during Q1 10,000,000 2020. 0 Q3 Q4 1 ■ Total PowerShell malware grew 1,902% over the 2019 2020 previous four quarters. Source: McAfee Labs, 2020. ■ New Mobile Malware increased 71% during Q1 2020 compared to the previous quarter, primarily due to Trojans. ■ Total mobile malware grew nearly 12% over previous e oerhell Malare four quarters. 1,00,000 ■ New IoT Malware (58%) and New MacOS Malware (51%) 1,00,000 rose by more than 50%. 1,200,000 ■ New Coin Miner Malware increased 26%. 1,000,000 ■ New Linux rose 8%. 00,000 The following categories showed reductions in Q1 2020 00,000 compared to the previous quarter: 00,000 200,000 ■ New Exploit Malware decreased 56%. 0 ■ New JavaScript Malware decreased 38%. Q3 Q4 1 ■ New Malware decreased 35%. 2019 2020 ■ New Ransomware decreased 12%. Source: McAfee Labs, 2020. Follow ■ New Malicious Signed Binaries decreased 11%. Share 10 McAfee Labs COVID-19 Threats Report, July 2020 REPORT KEY TOPIC e Macro Malare e Moble Malare 1,00,000 1,00,000 1,00,000 1,00,000 1,00,000 1,200,000 1,200,000 1,000,000 1,000,000 00,000 00,000 00,000 00,000 00,000 00,000 200,000 200,000 0 0 Q3 Q4 1 Q3 Q4 1 2019 2020 2019 2020 Source: McAfee Labs, 2020. Source: McAfee Labs, 2020. e IoT Malare e O Malare 0,000 ,00 0,000 ,000 0,000 2,00 0,000 2,000 0,000 1,00 0,000 1,000 20,000 10,000 00 0 0 Q3 Q4 1 Q3 Q4 1 2019 2020 2019 2020 Source: McAfee Labs, 2020. Source: McAfee Labs, 2020. Follow Share 11 McAfee Labs COVID-19 Threats Report, July 2020 REPORT KEY TOPIC e Co Mer Malare e Lu Malare ,000,000 10,000 ,00,000 12,000 ,000,000 ,00,000 100,000 ,000,000 2,00,000 ,000 2,000,000 0,000 1,00,000 1,000,000 2,000 00,000 0 0 Q3 Q4 1 Q3 Q4 1 2019 2020 2019 2020 Source: McAfee Labs, 2020.