Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

COVID-19: Coronavirus Fears Seized by Cybercriminals

Malware and phishing campaigns use global interest in the novel coronavirus to capitalize on fear and uncertainty around the pandemic.


In December 2019, reports of an outbreak of a new virus and disease, dubbed COVID-19 by the World Health Organization (WHO), began to emerge. COVID-19 is a novel coronavirus, which has captured global attention and is now considered a pandemic. Since December, COVID-19 has spread to more than 100 countries, with cases being reported every day. With such intense interest in the disease and the uncertainty around it, cybercriminals have found COVID-19 serves as the perfect lure to target users in a variety of ways, including leveraging it as part of malicious emails to phish users and spread digital viruses.

Coronavirus-themed malware campaigns

Emotet campaign

At the end of January 2020, researchers began observing attempts to distribute the Emotet malware in emails targeting users in Japan using COVID-19 as the lure.

IBM’s X-Force team compiled some indicators of compromise on January 29 and published a summary blog post on February 5. Emotet is part of a chain of three malware strains dubbed the Triple Threat by researchers at Cybereason. Emotet is responsible for bringing the TrickBot trojan into compromised environments, and TrickBot has been identified as a precursor to a Ryuk ransomware infection.

AZORult trojan

Researchers at Proofpoint published a blog post on February 10, highlighting a unique malicious spam campaign leveraging the genuine concerns around COVID-19 and its impact on global shipping.

COVID-19 Coronavirus Scams AZORult Trojan

Image source: Proofpoint blog

The malicious Microsoft Word document found in this email exploits CVE-2017-11882, a memory corruption vulnerability in Microsoft Office’s Equation Editor component.

Once exploited, the AZORult trojan is installed on the compromised system. AZORult is an information-stealing trojan first identified in 2016, which exfiltrates sensitive data from a compromised system.

On March 9, researchers at Reason Labs observed cybercriminals continuing to use COVID-19 concerns to spread AZORult again.

COVID-19 Coronavirus Scams AZORult Trojan 2

Image source: Reason Labs blog

The cybercriminals distributed a fake version of the Johns Hopkins Coronavirus Map in the form of a malicious executable. However, it is unclear whether they used malicious email or social media to distribute this malicious executable.

Nanocore Remote Access Trojan (RAT)

On February 13, researchers from the Cisco Talos team published a blog post highlighting how threat actors were capitalizing on the coronavirus outbreak. It began by referencing the Emotet campaigns discussed earlier. However, they also found campaigns using COVID-19 fears to distribute the Nanocore RAT.

coronavirus COVID-19 scams Nanocore RAT.png

Image source: Cisco Talos blog

The malicious email subject read, “Coronavirus Update: China Operations” and the contents discuss the impact of COVID-19 on a company’s operations in China with a malicious attachment inside a ZIP file. The email references a company, but it is unclear whether the cybercriminals repurposed part of a genuine company email or wrote it themselves.

Lokibot trojan

On February 14, IBM X-Force researchers shared details about another coronavirus-themed malicious spam campaign, this time targeting users in China. According to IBM X-Force, the malicious spam campaign claimed to be from the Ministry of Health of the People’s Republic of China.

coronavirus COVID-19 scams Lokibot trojan

Image source: IBM X-Force Exchange

The email uses official imagery and addresses the user by the username component of their email address. The email provides so-called precautions to “stay safe as death toll keeps increasing” and contains a malicious attachment, referred to as an “Emergency Regulation Ordinance Against Coronavirus,” in the form of an .arj file, a Windows RAR archive file. Once the attachment is opened, it results in a Lokibot trojan infection. Lokibot trojan is an information stealer, keylogger and more that first appeared as a password and cryptocurrency wallet stealer in 2015 on hacker forums. 

TrickBot trojan

On March 4, researchers at Sophos published a blog post about a malicious spam campaign targeting users in Italy with a list of precautions they can take to prevent the infection of COVID-19.

COVID-19 coronavirus scams TrickBot trojan

Image Source: SophosLabs blog

The email contains a malicious Word document that includes a Visual Basic for Applications script responsible for downloading the TrickBot trojan.

Coronavirus-themed phishing attacks

In addition to COVID-19 themed malware campaigns, cybercriminals are also leveraging the threat in traditional phishing campaigns.

On February 7, researchers at Kaspersky published a blog post detailing a phishing campaign that claimed to originate from the U.S. Centers for Disease Control and Prevention (CDC).

Coronavirus-themed phishing attacks

Image source: Kaspersky blog

This phishing email says the CDC is closely monitoring the COVID-19 outbreak and established an “Incident Management System'' for coordinating the public health response both domestically and internationally. It appears to include a link to a cdc.gov webpage. However, this link actually directs users to a website that looks like a Microsoft Outlook page. The page contains a username and password prompt for users to log in. It is an attempt by the cybercriminals to steal login credentials, as they hope to gain access to these accounts and start pouring through emails, looking for valuable information.

On March 5, researchers at Check Point Software Technologies published a blog post identifying newly registered domain names that included the word coronavirus in them. Since January 2020, Check Point researchers say they’ve identified over 4,000 of these so-called coronavirus domains. They found 3% of these domains were malicious, while 5% were suspicious. Check Point says these domains are “50% more likely to be malicious” than other domains registered during this time period.

Warnings from WHO, FTC and CISA

 The WHO,  the U.S. Federal Trade Commission (FTC) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have published advisories warning consumers about the threats posed by cybercriminals seeking to capitalize on the fear and uncertainty surrounding COVID-19. See below:

Stay informed about digital threats related to COVID-19

As we’re still in the earliest stages of the COVID-19 outbreak, it’s important to understand that these types of attacks will continue for the foreseeable future. Cybercriminals love to prey on the fears and uncertainty surrounding major global events, and as COVID-19 continues to pose a threat, cybercriminals will continue to leverage it as part of their campaigns.

The best way to protect yourself against digital threats leveraging the interest in COVID-19 is to stay informed. If you receive an email about COVID-19, be skeptical, especially if it contains an attachment. Visit your local government health organization’s or WHO’s website for the latest information about COVID-19.

加入 Tenable Community 中的 Tenable 安全响应团队

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 30-day trial of Tenable.io Vulnerability Management.



作者:Robert Huber • 2020 年 8 月 5 日 - 上午 8:45

Tenable Research 在 Plex Media Server 上发现多个漏洞

作者:Tenable Research • 2020 年 6 月 16 日 - 上午 9:00

订阅 Tenable 博客

免费试用 立即购买

选择 Tenable.io

免费试用 30 天

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即注册。

立即购买 Tenable.io

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

65 项资产



免费试用 立即购买

免费试用 Nessus Professional

免费试用 7 天

Nessus® 是当今市场上功能最全面的漏洞扫描器。Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间,并让您调动起 IT 团队的积极性。

购买 Nessus Professional

Nessus® 是当今市场上功能最全面的漏洞扫描器。Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间,并让您调动起 IT 团队的积极性。

购买多年期许可,即享优惠价格添加高级支持功能,获取一年 365 天、一天 24 小时的电话、社区和聊天支持。完整介绍请见此处。

免费试用 立即购买

试用 Tenable.io Web Application Scanning

免费试用 30 天

完整享有专为现代化应用程序而设、属于 Tenable.io 平台组成部分的最新 Web 应用程序扫描功能。可安全扫描全部在线资产组合的漏洞,具有高度准确性,而且无需繁重的手动操作或中断关键的 Web 应用程序。 立即注册。

购买 Tenable.io Web Application Scanning

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

5 个 FQDN



免费试用 联系销售人员

试用 Tenable.io Container Security

免费试用 30 天

完整获得已集成至漏洞管理平台之唯一容器安全产品的功能。监控容器映像中的漏洞、恶意软件和策略违规。与持续集成和持续部署 (CI/CD) 系统进行整合,以支持 DevOps 实践、增强安全性并支持企业政策合规。

购买 Tenable.io Container Security

Tenable.io Container Security 经由与构建流程的集成,可供全面了解容器映像的安全性,包括漏洞、恶意软件和策略违规,借以无缝且安全地启用 DevOps 流程。

了解有关 Industrial Security 的详情

获取 Tenable.sc 演示

请将您的联系方式填写在下方表格中,我们的销售代表很快与您联系安排演示。您也可以写下简短评论(不得超过 255 个字符)。请注意,带星号 (*) 的字段为必填项。

免费试用 联系销售人员

试用 Tenable Lumin

免费试用 30 天

通过 Tenable Lumin 直观呈现及探索 Cyber Exposure,长期追踪风险降低状况,并比照同行业者进行基准度量。

购买 Tenable Lumin

联系销售代表,了解 Lumin 如何帮助获取整个企业的洞见并管理网络风险。

申请演示 Tenable.ot