If you have cybersecurity concerns or are experiencing an incident, IBM X-Force IRIS is here to help. Contact us. US hotline 1-888-241-9812; Global hotline (+001) 312-212-8034

Global events such as the novel coronavirus (COVID-19) make all of us attractive targets for cybercriminals. Whether it’s phishing emails or new targeted scams, these tactics are meant to take advantage of citizens who are understandably concerned about their health and safety during this challenging time.

COVID-19 email exploits can deliver damaging ransomware and other dangerous cyberthreats. X-Force Incident Response and Intelligence Services (IRIS) has decades of experience responding to these kinds of attacks. At the same time, this is a developing situation. We must remain vigilant and be on the lookout for criminals using scare tactics as a lure to encourage us to open malicious emails, potentially compromising our network security with malware that can steal our browsing history, IDs, passwords and other personal information.

We remain committed to keeping clients safe during this global event. To that end, we have created a consolidated X-Force Exchange Collection of known threat actors and how they’re exploiting COVID-19. It’s important you take a few moments and familiarize yourself with the basic recommendations in the collection. You should also be aware of the specific, known cyber activity related to COVID-19. This information is detailed in the links on the right side of the page under “Linked Collections.”

X-Force will update this collection with additional information as it becomes available. Please bookmark this URL and check back regularly for the latest threat actor information.

We are also offering public access to the X-Force IRIS COVID-19 Threat Intelligence Enclave brought to you by TruSTAR. TruSTAR combines X-Force IRIS Intelligence with a broad ecosystem intelligence, and the enclave makes urgent COVID-19 information more accessible, helping keep all of us more protected. The TruSTAR platform is available for 90 days at no-cost, beginning March 20, 2020.

Recommendations for Our Clients:

  • Security always starts with the basics. Ensure your systems are patched and IDS/IPS signatures and associated files are up to date. Attackers rely heavily on unpatched and out-of-date network configurations. Learn more about larger cyberthreat trends by downloading the X-Force Threat Intelligence Index 2020.
  • Access and share threat intelligence about COVID-19 threats at no charge for 90 days by joining the X-Force IRIS COVID-19 Threat Intelligence Enclave brought to you by TruSTAR. Learn more about other IRIS intel solutions here.
  • Keep applications and operating systems running at the current released patch level. Check X-Force Exchange for the latest vulnerabilities tracked by X-Force Red.
  • The Quad9 platform — available at no cost — can also help clients detect and block spoofed domains.
  • Consider using this time as an opportunity to test your own cyber resilience plan. A well-tested plan can help you reduce downtime and limit financial and reputational impact. Learn more about how IBM Security X-Force’s threat intelligence and incident response services can help you develop and test a robust plan to fortify your cyber resilience.
Register for the webinar to learn how to stay safe during COVID-19 uncertainty

More from Threat Intelligence

Hive0147 serving juicy Picanha with a side of Mekotio

17 min read - IBM X-Force tracks multiple threat actors operating within the flourishing Latin American (LATAM) threat landscape. X-Force has observed Hive0147 to be one of the most active threat groups operating in the region, targeting employee inboxes at scale, with a primary focus on phishing and malware distribution. After a 3-month break, Hive0147 returned in July with even larger campaign volumes, and the debut of a new malicious downloader X-Force named "Picanha,” likely under continued development, deploying the Mekotio banking trojan. Hive0147…

FYSA – Critical RCE Flaw in GNU-Linux Systems

2 min read - Summary The first of a series of blog posts has been published detailing a vulnerability in the Common Unix Printing System (CUPS), which purportedly allows attackers to gain remote access to UNIX-based systems. The vulnerability, which affects various UNIX-based operating systems, can be exploited by sending a specially crafted HTTP request to the CUPS service. Threat Topography Threat Type: Remote code execution vulnerability in CUPS service Industries Impacted: UNIX-based systems across various industries, including but not limited to, finance, healthcare,…

Hive0137 and AI-supplemented malware distribution

12 min read - IBM X-Force tracks dozens of threat actor groups. One group in particular, tracked by X-Force as Hive0137, has been a highly active malware distributor since at least October 2023. Nominated by X-Force as having the “Most Complex Infection Chain” in a campaign in 2023, Hive0137 campaigns deliver DarkGate, NetSupport, T34-Loader and Pikabot malware payloads, some of which are likely used for initial access in ransomware attacks. The crypters used in the infection chains also suggest a close relationship with former…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today