Stimulus Payments Are Popular Leverage for Cyberattacks

Global governments have responded to the coronavirus crisis with stimulus payments intended to help people and businesses. As these Economic Impact Payments roll out across the United States, criminals are launching malicious domains and phishing campaigns to target recipients.

Attackers have been trying to cash in on the COVID-19 pandemic since it started. Nearly one-fifth of phishing emails identified on the Gmail platform include coronavirus or COVID-19 in their content, Google reports. In the week of April 6 to 13, it found roughly 18 million emails were rejected per day because they preyed on crisis-related concerns. These use fear or monetary incentives to trick victims and often pretend to be government agencies or credible NGOs.

Now, instead of preying on virus-related fears, cybercriminals are targeting stimulus payouts. A total of 4,305 domains related to new stimulus or relief packages have been registered since January, Check Point researchers report. This includes 2,081 new domains registered in March; of these, 38 were malicious and 583 were suspicious. In the first week of April, 473 new domains were registered; of these, 18 were malicious and 73 were suspicious. Researchers saw a big spike in registrations starting March 16, when the government proposed the stimulus package.

Emails containing malicious attachments were sent with subjects related to the stimulus. One read "RE: UN COVID-19 Stimulus" and distributed the AgentTesla malware. Another read "COVID-19 Payment" and distributed the Zeus Sphinx Trojan. These emails held links directing the recipient to a phishing login page, where the final payload was delivered.

Ninety-four percent of coronavirus-related attacks Check Point saw over the past two weeks were phishing attacks. Three percent were mobile attacks conducted via dedicated mobile malware or via malicious activity carried out on a mobile device. The overall number of cyberattacks has spiked to an average of 14,000 per day over the past two weeks, researchers report, which is six times the average number of daily attacks when compared with the two weeks prior. In the week starting April 7, 2020, the average number of daily attacks jumped to 20,000.

While the Check Point team has seen an increase in the number of stimulus-related domains, it's worth noting they have also noticed growth in the number of coronavirus-related domains overall. Since April 2, nearly 17,000 coronavirus-related domains have been registered; 2% of these were found to be malicious and 21% were considered suspicious. In total, there have been 68,000 coronavirus-related domains registered since the outbreak started in January. 

"If you receive an email asking you to do something that a legitimate loan officer would never request – the transfer of money, the disclosure of PII/bank account/credit card information, etc. – then you should consider the email of a 'red flag-level,' highly suspicious nature," said Pondurance senior security analyst Chip Henderson in a blog post on stimulus scams. If an email from an unknown sender demands you to "immediately" view an attachment or click a link in exchange for financial gain, the best thing you and your employees can do is delete it, he said.

Check Point urges citizens to be aware of lookalike domains that claim to be related to the IRS or government agencies, and to watch for spelling errors in emails or websites. Employees should be careful when handling files from unknown senders and reviewing "special" offers, such as a cure for coronavirus or something similar. When ordering products online, they should avoid promotional links and instead Google the retailer to shop from the legitimate site.

Related Content:

A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19. 

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Cybersecurity Home-School: The Robot Project"