As the COVID-19 pandemic expands, so too have the cyberattacks that are targeting Canadian businesses and employees. With most work shifted to remote, at-home environs and nerves frayed, workplaces and workers have never been more vulnerable.
Agencies at the federal and international level have been alerting businesses about the rise in scams for weeks. For example, the World Health Organization first warned of a dramatic increase in cyberattack incidents in late March. Hackers there were attempting to steal agency employee’s email credentials.
The Canadian Anti-Fraud Centre received 75 claims of COVID-9 fraud in March alone, with at least 13 successfully duping someone.
Why focus on email addresses and passwords? Because such fraudulent credentials can be used not only to access WHO systems but more critically, be used to impersonate the agency in phishing schemes. In Canada, the CBC characterized the battle against cyber attackers as “waging war against another type of virus: disinformation.”
The national Communications Security Establishment has already stopped widespread attacks spoofing the Canada Border Services Agency, Canada Revenue, and the Public Health Agency of Canada.
The attacks are widespread, hitting various industries. One report indicated that a Russian dark web site was selling administrative access to a Canadian university’s domain for $20,600. A cyberattack in late March struck Alberta’s Brewers Distributor Ltd., restricting the company’s ability to fulfill orders for liquor stores. Two weeks later, the business was still having trouble.
Government agencies are also increasingly vulnerable, primarily as some employees use their smartphones or computers instead of issued equipment. Many of these devices do not have the security provisions necessary to protect against threat actors.
The government issue is complicated by directives from many federal departments asking employees to refrain from working on internal servers unless working on critical services. Those servers have capacity limitations, and agencies are instead encouraging the use of non-government tools for non-sensitive work.
That could be a reckless decision, according to Steve Waterhouse, a cybersecurity consultant, and former IT officer for the Department of National Defence. Underline it, put it in bold and in italics: do not follow that procedure,” he told the National Post. “The government has never been as vulnerable as it is today because everyone is working outside of the office.”
Phishing attacks that mimic officials at various agencies are active today, given the urgency of the messaging and the public’s desire for information. Phishing emails typically include an attachment or link that claims to lead to important information about the virus or the agency’s response. However, clicking on either can launch malware that takes hold in a computer and can expose networks and data. In some cases, theft of information is the desired outcome. Others are ransomware attacks that hold websites hostage until payments are sent.
Fraudsters are also using text messages that mimic unemployment claims processing or the Public Health Agency of Canada. Prime Minister Justin Trudeau noted in a daily briefing about one scheme with texts offering cash from the federal government’s Emergency Response Benefit.
Joe Martin, Compunet’s Strategic Account Manager, suggests businesses take the following steps to protect against cyberattacks:
Compunet Infotech is here to help with your COVID-19 cybersecurity needs. We offer comprehensive IT security and ransomware prevention services. To learn more, contact us today.
Partner with Compunet Infotech and receive: