IBM finds phishing attack on Covid vaccine supply chain

IBM finds phishing attack on Covid vaccine supply chain

In addition to the ongoing string of cybersecurity attacks, IBM cybersecurity analysts recently uncovered an email phishing scheme that has been targeting coronavirus vaccine supply chains. The analysts found fraudulent emails impersonating a Chinese Business executive at a credible cold-chain supply company. 

IBM has said that the “purpose of this campaign may have been to harvest credentials to gain future unauthorized access” and that “the adversary could gain insight into internal communications, as well as the process methods and plans to distribute a COVID-19 vaccine.” Phishing attempts such as this are often very successful because they tend to focus on convincing employees with access to sensitive information to make a mistake.

It’s believed that the targeted organizations were linked to Gavi, The Vaccine Alliance, which focuses on helping the distribution and supply of an affordable coronavirus vaccine to low and middle income economies. Gavi has not disclosed whether or not the phishing campaign was able to access sensitive information regarding vaccine distribution. A spokesperson has said that “Gavi has strong policies and processes in place to prevent such phishing attacks and hacking attempts,” and that they are “working closely with our partners on security awareness to continue to strengthen these best practices.” Some governments have warned of an increase in malicious cyber threats related to Covid-19 attempting to steal sensitive information. In IBM’s report it “urges companies in the COVID-19 supply chain … to be vigilant and remain on high alert during this time.”

This is why we built TWOSENSE, to focus on the core of sensitive information, the user. All it takes is one mistake and these days not only are attacks more frequent, they’re more convincing. In order to become more secure, organizations have to shore up gaps and address the weakest link: human error. TWOSENSE uses continuous authentication to automate the human effort and therefore the human error out of security. Even if a user makes a mistake and a malicious actor gains access to sensitive information, TWOSENSE can catch them before it’s too late.