Stimulus Payments Are Popular Leverage for Cyberattacks

More than 4,300 domains related to stimulus and relief packages, many of them malicious, have been registered since January.

Global governments have responded to the coronavirus crisis with stimulus payments intended to help people and businesses. As these Economic Impact Payments roll out across the United States, criminals are launching malicious domains and phishing campaigns to target recipients.
Attackers have been trying to cash in on the COVID-19 pandemic since it started. Nearly one-fifth of phishing emails identified on the Gmail platform include coronavirus or COVID-19 in their content, Google reports. In the week of April 6 to 13,
it found
roughly 18 million emails were rejected per day because they preyed on crisis-related concerns. These use fear or monetary incentives to trick victims and often pretend to be government agencies or credible NGOs.
Now, instead of preying on virus-related fears, cybercriminals are targeting stimulus payouts. A total of 4,305 domains related to new stimulus or relief packages have been registered since January, Check Point researchers report. This includes 2,081 new domains registered in March; of these, 38 were malicious and 583 were suspicious. In the first week of April, 473 new domains were registered; of these, 18 were malicious and 73 were suspicious. Researchers saw a big spike in registrations starting March 16, when the government proposed the stimulus package.
Emails containing malicious attachments were sent with subjects related to the stimulus. One read RE: UN COVID-19 Stimulus and distributed the AgentTesla malware. Another read COVID-19 Payment and distributed the Zeus Sphinx Trojan. These emails held links directing the recipient to a phishing login page, where the final payload was delivered.
Ninety-four percent of coronavirus-related attacks Check Point saw over the past two weeks were phishing attacks. Three percent were mobile attacks conducted via dedicated mobile malware or via malicious activity carried out on a mobile device. The overall number of cyberattacks has spiked to an average of 14,000 per day over the past two weeks, researchers
report
, which is six times the average number of daily attacks when compared with the two weeks prior. In the week starting April 7, 2020, the average number of daily attacks jumped to 20,000.
While the Check Point team has seen an increase in the number of stimulus-related domains, its worth noting they have also noticed growth in the number of coronavirus-related domains overall. Since April 2, nearly 17,000 coronavirus-related domains have been registered; 2% of these were found to be malicious and 21% were considered suspicious. In total, there have been 68,000 coronavirus-related domains registered since the outbreak started in January.
If you receive an email asking you to do something that a legitimate loan officer would never request – the transfer of money, the disclosure of PII/bank account/credit card information, etc. – then you should consider the email of a red flag-level, highly suspicious nature, said Pondurance senior security analyst Chip Henderson in a
blog post
on stimulus scams. If an email from an unknown sender demands you to immediately view an attachment or click a link in exchange for financial gain, the best thing you and your employees can do is delete it, he said.
Check Point urges citizens to be aware of lookalike domains that claim to be related to the IRS or government agencies, and to watch for spelling errors in emails or websites. Employees should be careful when handling files from unknown senders and reviewing special offers, such as a cure for coronavirus or something similar. When ordering products online, they should avoid promotional links and instead Google the retailer to shop from the legitimate site.
Related Content:
7 Ways COVID-19 Has Changed Our Online Lives
How Enterprises Are Developing and Maintaining Secure Applications
8 Phishing Lures Preying on Pandemic Panic
Microsoft Releases COVID-19 Security Guidance
A listing of
free products and services
compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19.
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays featured story:
Cybersecurity Home-School: The Robot Project

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Stimulus Payments Are Popular Leverage for Cyberattacks