If you have cybersecurity concerns or are experiencing an incident, IBM X-Force IRIS is here to help. Contact us. US hotline 1-888-241-9812; Global hotline (+001) 312-212-8034

Global events such as the novel coronavirus (COVID-19) make all of us attractive targets for cybercriminals. Whether it’s phishing emails or new targeted scams, these tactics are meant to take advantage of citizens who are understandably concerned about their health and safety during this challenging time.

COVID-19 email exploits can deliver damaging ransomware and other dangerous cyberthreats. X-Force Incident Response and Intelligence Services (IRIS) has decades of experience responding to these kinds of attacks. At the same time, this is a developing situation. We must remain vigilant and be on the lookout for criminals using scare tactics as a lure to encourage us to open malicious emails, potentially compromising our network security with malware that can steal our browsing history, IDs, passwords and other personal information.

We remain committed to keeping clients safe during this global event. To that end, we have created a consolidated X-Force Exchange Collection of known threat actors and how they’re exploiting COVID-19. It’s important you take a few moments and familiarize yourself with the basic recommendations in the collection. You should also be aware of the specific, known cyber activity related to COVID-19. This information is detailed in the links on the right side of the page under “Linked Collections.”

X-Force will update this collection with additional information as it becomes available. Please bookmark this URL and check back regularly for the latest threat actor information.

We are also offering public access to the X-Force IRIS COVID-19 Threat Intelligence Enclave brought to you by TruSTAR. TruSTAR combines X-Force IRIS Intelligence with a broad ecosystem intelligence, and the enclave makes urgent COVID-19 information more accessible, helping keep all of us more protected. The TruSTAR platform is available for 90 days at no-cost, beginning March 20, 2020.

Recommendations for Our Clients:

  • Security always starts with the basics. Ensure your systems are patched and IDS/IPS signatures and associated files are up to date. Attackers rely heavily on unpatched and out-of-date network configurations. Learn more about larger cyberthreat trends by downloading the X-Force Threat Intelligence Index 2020.
  • Access and share threat intelligence about COVID-19 threats at no charge for 90 days by joining the X-Force IRIS COVID-19 Threat Intelligence Enclave brought to you by TruSTAR. Learn more about other IRIS intel solutions here.
  • Keep applications and operating systems running at the current released patch level. Check X-Force Exchange for the latest vulnerabilities tracked by X-Force Red.
  • The Quad9 platform — available at no cost — can also help clients detect and block spoofed domains.
  • Consider using this time as an opportunity to test your own cyber resilience plan. A well-tested plan can help you reduce downtime and limit financial and reputational impact. Learn more about how IBM Security X-Force’s threat intelligence and incident response services can help you develop and test a robust plan to fortify your cyber resilience.
Register for the webinar to learn how to stay safe during COVID-19 uncertainty

more from Advanced Threats

Black Hat 2022 Sneak Peek: How to Build a Threat Hunting Program

You may recall my previous blog post about how our X-Force veteran threat hunter Neil Wyler (a.k.a “Grifter”) discovered nation-state attackers exfiltrating unencrypted, personally identifiable information (PII) from a company’s network, unbeknownst to the security team. The post highlighted why threat hunting should be a baseline activity in any environment. Before you can embark on a threat hunting exercise, however,…

World’s Largest Darknet Market Shut Down, $25 Million in Bitcoin Seized

On April 5, German authorities announced the takedown of the Hydra marketplace, the world’s largest darknet market trading in illicit drugs, cyberattack tools, forged documents and stolen data. The criminal operation, with about 17 million customer accounts, raked in billions in bitcoin before getting shut down. On its website, the Federal Criminal Police Office (BKA) stated it had secured and…