The FBI Warns of Increased Cyber Risks Surrounding the Coronavirus Pandemic

As the world’s population continues to be gripped with fear and anxiety over coronavirus, hackers are taking advantage of the climate to orchestrate a variety of cyber attacks.

The FBI recently issued a public service announcement warning of an increase in these attacks. These not only include email and fraud schemes mentioned in a previous public service announcement, but also attacks on remote desktop and virtual environments, as well as distance learning and education platforms.

“Cyber attackers take advantage of chaos,” advised Brian Walker. “And these unprecedented times can certainly be considered chaotic. These criminals are opportunistic, and they are taking advantage of the current climate to launch a wide assortment of campaigns. We ask our colleagues and clients to be prepared for an increase in scams and attacks.”

Remote environment vulnerabilities

There’s been a dramatic surge of employees working from home for companies with remote capabilities. And you bet cybercriminals are aware.

“For companies scrambling to get the required remote infrastructure set up to enable work-from-home for their employees, care must be taken when selecting software and hardware,” said Aaron Allen. “Only obtain these from trusted sources.”

“Thrive can help you set up your remote environment, as well as manage it and keep it secure against attacks.”

For companies who already have remote work capabilities for their employees, be on the lookout for scammers trying to gain access. Criminals have numerous tactics, including:

• Phishing emails that try to get users to provide account credentials.
• Attacks on remote desktop access vulnerabilities.
• Brute force attacks.

Whether your company is setting up a remote environment or managing one, diligence and common sense – as well as an awareness of the variety of attacks that can be unleashed against your network – can help you stay safe.

Education technology attacks

Because most citizens have been ordered to stay home during this pandemic, schools have had to quickly shift to distance learning models. These provide convenient ways for students to continue their studies.

Unfortunately, these provide other vectors of attack for cybercriminals.

The FBI announcement described a 2017 attack on multiple United States school districts, where attackers breached networks and obtained sensitive records. These were used to threaten and extort students and their families.

Besides breaching networks, criminals can also focus on social engineering and email attacks to gain access.

As with any IT environment, security needs to be a number one priority.

“Thrive uses best-of-breed hardware and software to facilitate distance learning,” explained Walker. “Security is a prime consideration in everything we do. Unfortunately, criminals are targeting young students, who may not have the necessary experience to avoid sophisticated social engineering and phishing attacks.

“Both parents and teachers need to be aware of the attacks that are happening right now, so they can help students stay aware.”

Per the FBI’s Internet Crime Complaint Center (www.ic3.gov), here are some tips for staying safe.

Remote Working Tips:

Do:

• Select trusted and reputable telework software vendors; conduct additional due diligence when selecting foreign-sourced vendors.
• Restrict access to remote meetings, conference calls, or virtual classrooms, including the use of passwords if possible.
• Beware of social engineering tactics aimed at revealing sensitive information. Make use of tools that block suspected phishing emails or allow users to report and quarantine them.
• Beware of advertisements or emails purporting to be from telework software vendors.
• Always verify the web address of legitimate websites or manually type it into the browser.

Don’t:

• Share links to remote meetings, conference calls, or virtual classrooms on open websites or open social media profiles.
• Open attachments or click links within emails from senders you do not recognize.
• Enable remote desktop access functions like Remote Desktop Protocol (RDP) or Virtual Network Computing (VNC) unless absolutely needed.

Education Technology Tips:

Do:

• Closely monitor children’s use of edtech and online services.
• Research edtech service user agreements about data breach notifications, marketing, and/or selling of user data, data retention practices, and whether users and/or parents can elect to have student data deleted by request.
• Conduct regular internet searches of children’s information to monitor the exposure and spread of their information on the internet.
• Consider credit or identity theft monitoring to check for any fraudulent use of their child’s identity.
• Research parent coalition and information-sharing organizations available online for those looking for support and additional resources.
• Research school-related, edtech, and other related vendor cyber breaches, which can further inform families of student data and security vulnerabilities.

Don’t:

• Provide exact information on children when creating user profiles (e.g., use initials instead of full names, avoid using exact dates of birth, avoid including photos, etc.)

View the full FBI Public Service Announcement – Alert #I-040120-PSA here:

https://www.ic3.gov/media/2020/200401.aspx

The public service announcement also gives tips for repelling Business Email Compromise attacks, and offers general vulnerability details to help keep you safe.

For more information, schedule a free consultation with Thrive! Get started by contacting Thrive today.