If you have cybersecurity concerns or are experiencing an incident, IBM X-Force IRIS is here to help. Contact us. US hotline 1-888-241-9812; Global hotline (+001) 312-212-8034

Global events such as the novel coronavirus (COVID-19) make all of us attractive targets for cybercriminals. Whether it’s phishing emails or new targeted scams, these tactics are meant to take advantage of citizens who are understandably concerned about their health and safety during this challenging time.

COVID-19 email exploits can deliver damaging ransomware and other dangerous cyberthreats. X-Force Incident Response and Intelligence Services (IRIS) has decades of experience responding to these kinds of attacks. At the same time, this is a developing situation. We must remain vigilant and be on the lookout for criminals using scare tactics as a lure to encourage us to open malicious emails, potentially compromising our network security with malware that can steal our browsing history, IDs, passwords and other personal information.

We remain committed to keeping clients safe during this global event. To that end, we have created a consolidated X-Force Exchange Collection of known threat actors and how they’re exploiting COVID-19. It’s important you take a few moments and familiarize yourself with the basic recommendations in the collection. You should also be aware of the specific, known cyber activity related to COVID-19. This information is detailed in the links on the right side of the page under “Linked Collections.”

X-Force will update this collection with additional information as it becomes available. Please bookmark this URL and check back regularly for the latest threat actor information.

We are also offering public access to the X-Force IRIS COVID-19 Threat Intelligence Enclave brought to you by TruSTAR. TruSTAR combines X-Force IRIS Intelligence with a broad ecosystem intelligence, and the enclave makes urgent COVID-19 information more accessible, helping keep all of us more protected. The TruSTAR platform is available for 90 days at no-cost, beginning March 20, 2020.

Recommendations for Our Clients:

  • Security always starts with the basics. Ensure your systems are patched and IDS/IPS signatures and associated files are up to date. Attackers rely heavily on unpatched and out-of-date network configurations. Learn more about larger cyberthreat trends by downloading the X-Force Threat Intelligence Index 2020.
  • Access and share threat intelligence about COVID-19 threats at no charge for 90 days by joining the X-Force IRIS COVID-19 Threat Intelligence Enclave brought to you by TruSTAR. Learn more about other IRIS intel solutions here.
  • Keep applications and operating systems running at the current released patch level. Check X-Force Exchange for the latest vulnerabilities tracked by X-Force Red.
  • The Quad9 platform — available at no cost — can also help clients detect and block spoofed domains.
  • Consider using this time as an opportunity to test your own cyber resilience plan. A well-tested plan can help you reduce downtime and limit financial and reputational impact. Learn more about how IBM Security X-Force’s threat intelligence and incident response services can help you develop and test a robust plan to fortify your cyber resilience.
Register for the webinar to learn how to stay safe during COVID-19 uncertainty

More from Threat Intelligence

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

13 min read - Summary As of March 2024, X-Force is tracking multiple ongoing ITG05 phishing campaigns featuring lure documents crafted to imitate authentic documents of government and non-governmental organizations (NGOs) in Europe, the South Caucasus, Central Asia, and North and South America. The uncovered lures include a mixture of internal and publicly available documents, as well as possible actor-generated documents associated with finance, critical infrastructure, executive engagements, cyber security, maritime security, healthcare, business, and defense industrial production. Beginning in November 2023, X-Force observed…

CVE-2023-20078 technical analysis: Identifying and triggering a command injection vulnerability in Cisco IP phones

7 min read - CVE-2023-20078 catalogs an unauthenticated command injection vulnerability in the web-based management interface of Cisco 6800, 7800, and 8800 Series IP Phones with Multiplatform Firmware installed; however, limited technical analysis is publicly available. This article presents my findings while researching this vulnerability. In the end, the reader should be equipped with the information necessary to understand and trigger this vulnerability.Vulnerability detailsThe following Cisco Security Advisory (Cisco IP Phone 6800, 7800, and 8800 Series Web UI Vulnerabilities - Cisco) details CVE-2023-20078 and…

X-Force data reveals top spam trends, campaigns and senior superlatives in 2023

10 min read - The 2024 IBM X-Force Threat Intelligence Index revealed attackers continued to pivot to evade detection to deliver their malware in 2023. The good news? Security improvements, such as Microsoft blocking macro execution by default starting in 2022 and OneNote embedded files with potentially dangerous extensions by mid-2023, have changed the threat landscape for the better. Improved endpoint detection also likely forced attackers to shift away from other techniques prominent in 2022, such as using disk image files (e.g. ISO) and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today