The U.S. Treasury Department's Financial Crimes Enforcement Network (FinCEN) warns financial organizations to be aware of campaigns actively targeting vaccine companies.
If you’re a ransomware gang and you want to maximize your ransom, who do you attack? An organization working feverishly to potentially make billions of dollars via a desperately needed vaccine, of course! Take away their ability to operate and even access intellectual property and you have yourself a very captive audience that needs to rectify the mess you’ve caused.
In a recent notice, FinCEN warned of two expected types of attacks:
- Ransomware attacks targeting “vaccine delivery operations as well as the supply chains required to manufacture the vaccines.”
- Phishing schemes luring victims from financial institutions and their customers with fraudulent information about COVID-19 vaccines.
This notice coincides with attacks we’ve seen on the COVID-19 “cold supply” chain (the part responsible for maintaining temperature-controlled environments for the vaccines), as well vaccine-themed phishing attacks attempting to stead personal information or payment details.
While the first type of attack focuses on a specific sector of business, the second applies to every organization. It’s just as easy for an attacker to impersonate your HR department and send out an email stating that free vaccines will be distributed… and to fill out a form (conveniently a Word doc that needs macros enabled…).
It’s critical that with tensions high and people wanting to get the vaccine, you need to educate your users via Security Awareness Training of these kinds of social engineering scams designed to trick them into engaging with the embedded malicious content.
Here's how it works:
