Insights into human error, stolen credentials, ransomware and phishing tactics used in the past months can help strengthen our cyberdefenses.

Since launching a security report in May 2020, we (at Verizon) have seen the COVID-19 pandemic deliver additional security challenges to businesses around the globe.

Unfortunately, in these times of rapid change and confusion, cybercriminals have been watching and looking to capitalize on any opportunity for financial gain. In order to shed light on the increasing number of threat actors worrying cybersecurity specialists, our Data Breach Investigations Report team has generated a three-month analysis that brings these threats under the spotlight.

This study focuses on 36 confirmed data breaches that were identified as being related directly to the COVID-19 pandemic. The study also reviews 474 data breach incidents from March – June 2020 based on contributor data and publicly-disclosed incidents.

We have combined this data with our own team’s observations drawn from our collective years of experience to ascertain the cyber-trends that have most impacted businesses during this time.

Focusing on the tried and tested

Pre-COVID-19, cybercriminals were successfully using tried-and-tested methods to obtain data. If these tactics worked in a stable business environment, they must have been working even better in an era of unprecedented disruption.

Criminals are ultimately lazy in their approaches, and, faced with a larger attack surface than usual during the pandemic, there has been no need to invent new attack strategies to achieve their goals.

Based on our observations we have seen the use of these common threats increase:

• Continued increase in human error: This factor is often seen as a major cause of security incidents. In fact we reported that nearly a quarter of the breaches analyzed in our 2020 data breach report were due to this. Faced with major disruption, increased workloads as a result of decreased workforces, and distractions during WFH days, no wonder more errors have been reported during the pandemic.
  
• Focus on stolen credential-related hacking:  Our report flagged that over 80% of breaches were caused by stolen or brute-forced credentials. This has now been exacerbated by the large number of employees working from home requiring ongoing remote-access and workstation maintenance. Business IT departments are being challenged to secure company assets on the corporate network while the majority of the staff are working out of the office. This has widened the number of remote targets for cybercriminals.
  
• Spikes in ransomware attacks: Several incidents reviewed within the COVID-19 dataset involved the use of ransomware. These involved the copying and posting of data (either partially or entirely) publicly online. Of the nine malware incidents in the COVID-19 dataset, seven were confirmed breaches demonstrating a spike in ransomware usage.
  
• Emotional lures in phishing emails: Phishing has always been a popular cybercrime tactic. Prior to COVID-19 we flagged credential theft and social attacks such as phishing and business email compromises as being the root of the majority of breaches: over 67%.
  
  Combine this attack success with uncertainty, fear and the need for COVID-19 information, then you will understand why phishing emails containing the words ‘COVID’ or ‘CORONAVIRUS’, ‘masks’, ‘test’, ‘quarantine’ and ‘vaccine’ were found to be widely used within this time period.
  
  We saw phishing emails unrelated to COVID-19 had a slightly lower click rate (with a median of 3.1%). The phishing emails that were linked to COVID-19 had a somewhat higher median at 4.1% and showed more organizations having far higher click rates: over 50% in some cases.
  
  A phishing simulation performed on approximately 16,000 people in late March (the early weeks of shelter-in-place for many states in the USA) found that almost three times as many people not only clicked on the phishing link, but also provided their credentials to the simulated login page than in pre-COVID-19 tests late last year. This heightened emotional response is completely understandable when COVID-19-related terms are involved and are being exploited by cybercriminals.

Using insights for defense

Businesses around the globe have continued to focus on serving their employees and customers as a priority throughout the pandemic.

Armed with insights into the evolving tactics used by cybercriminals during this period and comprehensive security strategies (such as managed security services, identity solutions and most importantly on-going employee education), we can set a more productive course to help create a more secure business environment and maintain business momentum.