If you have cybersecurity concerns or are experiencing an incident, IBM X-Force IRIS is here to help. Contact us. US hotline 1-888-241-9812; Global hotline (+001) 312-212-8034

Global events such as the novel coronavirus (COVID-19) make all of us attractive targets for cybercriminals. Whether it’s phishing emails or new targeted scams, these tactics are meant to take advantage of citizens who are understandably concerned about their health and safety during this challenging time.

COVID-19 email exploits can deliver damaging ransomware and other dangerous cyberthreats. X-Force Incident Response and Intelligence Services (IRIS) has decades of experience responding to these kinds of attacks. At the same time, this is a developing situation. We must remain vigilant and be on the lookout for criminals using scare tactics as a lure to encourage us to open malicious emails, potentially compromising our network security with malware that can steal our browsing history, IDs, passwords and other personal information.

We remain committed to keeping clients safe during this global event. To that end, we have created a consolidated X-Force Exchange Collection of known threat actors and how they’re exploiting COVID-19. It’s important you take a few moments and familiarize yourself with the basic recommendations in the collection. You should also be aware of the specific, known cyber activity related to COVID-19. This information is detailed in the links on the right side of the page under “Linked Collections.”

X-Force will update this collection with additional information as it becomes available. Please bookmark this URL and check back regularly for the latest threat actor information.

We are also offering public access to the X-Force IRIS COVID-19 Threat Intelligence Enclave brought to you by TruSTAR. TruSTAR combines X-Force IRIS Intelligence with a broad ecosystem intelligence, and the enclave makes urgent COVID-19 information more accessible, helping keep all of us more protected. The TruSTAR platform is available for 90 days at no-cost, beginning March 20, 2020.

Recommendations for Our Clients:

  • Security always starts with the basics. Ensure your systems are patched and IDS/IPS signatures and associated files are up to date. Attackers rely heavily on unpatched and out-of-date network configurations. Learn more about larger cyberthreat trends by downloading the X-Force Threat Intelligence Index 2020.
  • Access and share threat intelligence about COVID-19 threats at no charge for 90 days by joining the X-Force IRIS COVID-19 Threat Intelligence Enclave brought to you by TruSTAR. Learn more about other IRIS intel solutions here.
  • Keep applications and operating systems running at the current released patch level. Check X-Force Exchange for the latest vulnerabilities tracked by X-Force Red.
  • The Quad9 platform — available at no cost — can also help clients detect and block spoofed domains.
  • Consider using this time as an opportunity to test your own cyber resilience plan. A well-tested plan can help you reduce downtime and limit financial and reputational impact. Learn more about how IBM Security X-Force’s threat intelligence and incident response services can help you develop and test a robust plan to fortify your cyber resilience.
Register for the webinar to learn how to stay safe during COVID-19 uncertainty

More from Threat Intelligence

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns

16 min read - Since March 2024, IBM X-Force has been tracking several large-scale phishing campaigns distributing the Grandoreiro banking trojan, which is likely operated as a Malware-as-a-Service (MaaS). Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails. The latest malware variant also specifically targets over 1500 global banks, enabling attackers to perform banking fraud in over 60 countries…

Threat intelligence to protect vulnerable communities

2 min read - Key members of civil society—including journalists, political activists and human rights advocates—have long been in the cyber crosshairs of well-resourced nation-state threat actors but have scarce resources to protect themselves from cyber threats. On May 14, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released a High-Risk Communities Protection (HRCP) report developed through the Joint Cyber Defense Collaborative that addresses the threat to these vulnerable groups, with findings contributed by the X-Force Threat Intelligence team.Cyber criminals seek stolen credentialsThe HRCP…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today