Coronavirus: Cybercriminals seek to steal data on …

Coronavirus vaccines arouse greed among cybercriminals, who they multiply the attacks to interrupt their delivery or seize trade secrets, which forces laboratories and supply chain players to be more attentive. In a document, IT group IBM reported on a series of cyber attacks directed against the vaccine distribution chain, requiring the storage and transport of doses at very low temperatures.

“Our team recently discovered a global “phishing” campaign (spoofing) targeting organizations associated with the COVID-19 cold chain, ”blogged Claire Zaboeva and Melissa Frydrych, analysts at IBM X-Force, a working group dedicated to cybersecurity.

The vaccine developed by Pfizer and its German partner BioNTech, which received the green light for marketing in the United Kingdom on Wednesday, cannot be exposed to temperatures above -70 ° C to ensure its effectiveness.

The Directorate-General for Control and Customs, a service belonging to the European Commission, was one of the targets of the attack, as well as energy and IT companies from Germany, Italy, the Czech Republic, South Korea and Taiwan, IBM said.

To catch their victims, cybercriminals have mainly used the method of “spear phishing”, which involves posing as a known person to obtain confidential and sensitive data. The hackers sent fraudulent emails on behalf of an alleged head of Chinese company Haier Biomedical, which is effectively part of the vaccine supply chain and collaborates with the World Health Organization, Unicef ​​and other United Nations agencies.

In the messages, they prompted to provide passwords or credentials, which were subsequently exploited by malware. They have also tried to attack drug companies that are developing vaccines like the ones in the United States. Johnson & Johnson and Novavax, the British AstraZeneca and South Korean laboratories, according to the Wall Street Journal.

Spanish laboratories have been attacked by Chinese cybercriminals, El País newspaper reported in September.

In November, Cold storage giant Americold reported attack on its computer systems to the agency in charge of controlling the United States Stock Exchange, without specifying whether this action was linked to the group’s role in the storage of vaccines.

Motivations

IBM said it could not determine who was behind the attacks., but he assures us that his nature and sophistication make one think of a state actor.

For Mark Kedgleyc of cybersecurity software provider New Net Technologies, “Intellectual property related to powerful pharmaceuticals is of immense value to cybercriminals.” “In the case of covid-19 vaccines, it has to do with piracy at the nation state level,” he said.

The countries whose names are frequently cited by Western experts are Russia, China or North Korea, although there is no formal evidence against them.

Financial motivations cannot be excluded eithergiven the high profits left by the marketing of vaccines. “State and non-state actors try to use any situation to gain advantage, be it political or financial. It would have been inconceivable that covid-related efforts had not been targeted, ”said Brett Callow of Emsisoft, a cybersecurity company.

Monitoring

The U.S. cybersecurity agency CISA says IBM’s report should be taken seriously. “CISA encourages all organizations involved in vaccine storage and transport to strengthen their protections, primarily for cold storage operations, and to remain vigilant about any activity in this area,” said Josh Corman, researcher at CISA.

Laboratories are also on alert. “Most large pharmaceutical companies have the resources to detect and protect against malicious code,” said Marene Allison, security manager at Johnson & Johnson. “Unfortunately, this is not the case for everyone in the health sector,” he added.