The Federal Bureau of Investigation is seeing a rise in scams capitalizing on the Coronavirus (COVID-19) outbreak, and the Middle and East Tennessee community is at risk. Fraudsters are preying on your fear and sending all sorts of scams related to the Coronavirus. While many attempts use the “tried and true” methods of imitating authoritative organizations, new, innovative ways of taking advantage of the population are being deployed as well. We’ve gathered and adapted this content from resources shared by KnowBe4, a company that specializes in protecting companies against cybersecurity threats. The first blog is this series describes the more common types of scams you should be on the lookout for.
The Tried & True
Spoofs of authoritative sources of information continue to be the most common malicious virus-themed emails that are reported. And the top three spoofed organizations (“spoofed” meaning that scammers are posing as them) remain the CDC:
The WHO (World Health Organization):
And Human Resources:
As with the earlier spoofs reported, all three of these more recent emails lead to credentials phishes. The third (from HR) does take a bit of a novel approach, however, instructing recipients to download an attachment billed as an informational poster or flyer to be displayed on walls within the organization. The alleged poster/flyer is, in reality, just a standard credentials phish.
It’s also worth pointing out that the second email above (the WHO spoof) not only spoofs DocuSign (a frequent target of malicious spoofs) as well as the World Health Organization, but was delivered through SendGrid, a well-known email service provider widely used by many companies and organizations.
This isn’t the first time we’ve seen a malicious email campaign executed via what is almost certainly a compromised SendGrid account (we also regularly encounter malicious emails phishing for SendGrid account credentials). Indeed, malicious emails delivered through SendGrid are becoming more and more common – a worrisome trend, given that SendGrid is likely whitelisted within many organizations, allowing emails delivered via that service to sail right through firewalls and email filtering services straight into users’ inboxes.
Conclusion
Good information and education remain the best defense for malicious online scams. Unlike toilet paper, hand sanitizers, and medical masks, good information is not in short supply. Our hope is that by letting concerned users actually see the COVID-19-themed phishing emails that the media is widely reporting they can make better, more informed choices about how to navigate the flood of information landing in their inboxes at this stressful moment. emes trailing in the wake of the Coronavirus itself.
Check back for more examples of ways fraudsters are using emails to prey on peoples’ fears.
Sourced with permission from: Knowbe4
