Today’s blog post addresses the evolving threat of COVID-19 themed cyber attacks and the sophisticated techniques being used to deploy them.
What is the current threat?
Since our last blog post on online scams related to COVID-19, cybercriminals have become even more sophisticated in their approach. These phishing campaigns are still active, but now there are also other threats targeting users working from home, such as the IT Helpdesk scam.
This scam works by an email claiming to be from the employer’s help desk being distributed to employees, requesting that they log in to a new portal to access information on tasks. The Australian Cyber Security Centre (ACSC) shares further details at cyber.gov.au (refer to Case Study 7):
“Recipients who click on the link are directed to a malicious website that seeks to collect their username and password, which the cybercriminals then use to gain unauthorised access to the company’s corporate networks.”
Image: IT Helpdesk scam example email from cyber.gov.au
How do I stay safe?
As explained in our recent post, make sure you look out for any signs that an email or SMS is false, such as spelling errors, language use and suspicious looking sender details. Don’t click or open anything until it has been verified by the organisation, either by checking their website, social media accounts or mobile app. For additional advice on mitigation strategies visit cyber.gov.au.
Ram Mohan, Chief Operating Officer at Afilias shares his expertise on maintaining a secure connection while working from home in this recent article from Circle ID. He explains that the responsibility to protect organisational information now lies largely with the employees themselves:
“Encryption used to happen ‘in the background,’ usually handled by your Corporate IT staff. Now that we are all WFH, the responsibility to add appropriate levels of encryption to both maintain confidentiality and to preserve data and credential integrity has dramatically shifted to all of us.”
Mohan offers a number of ways to maintain a secure, encrypted connection including by logging in to a VPN each day, accessing websites with an SSL certificate (https://), using encrypted software and apps and modifying your privacy settings.
Awareness is key
Cybercriminals are attempting to exploit people and their information with increasingly sophisticated techniques, and we cannot let our awareness slip during COVID-19, or at any time. These criminals are experts in manipulation and will go to extreme lengths to get what they want.
While the .au namespace is closely monitored for threats, it is up to you to report any suspicious communications you receive, so that together we can ensure that being online while working from home is a safe option for all Australians.
Have a comment, question or idea for a future blog post? Email us at blog@afilias.com.au