Unknown Nation-State Attacking Vaccine Cold Chain in Phishing Scam, IBM Finds
Unknown Nation-State Attacking Vaccine Cold Chain in Phishing Scam, IBM Finds
(Bloomberg) -- Nation-state hackers have been masquerading the past few months as one of the world’s largest cold-chain providers in a global email phishing scam seemingly aimed at spying on entities essential to the global distribution of Covid-19 vaccines, researchers said.
X-Force, a digital security unit at force at International Business Machines Corp., discovered an email operation in which hackers claimed to represent Qingdao Haier Biomedical Co., a China-based company and one of the world’s largest cold-chain suppliers, making equipment to store and deliver materials at cold temperatures. In at least one copy of the spam email, the fake Haier representative sought to purchase about 500 vaccine refrigerators to bolster their temperature-controlled logistical services.
The user, who purports to serve as Haier’s project manager in Africa, promised a $220,000 upfront payment, according to an email provided by the IBM security researchers. Attached to the email is a draft contract entitled, “RFQ - UNICEF CCEOP and Vaccine Project.” But the HTML attachment was actually a malicious file that, if opened, would prompt the recipient to share their secret login credentials with the attacker.
IBM’s security team has been researching Covid-related cyber-attacks since the early days of the pandemic. Based on the sophistication of this attack, which targeted a variety of industries related to vaccine storage and delivery before hackers cleaned up their digital footprints, researchers believe the campaign was launched by a nation-state, but declined to speculate on which one.
It’s unclear if any victims fell for the scam. But if they did, the harvested credentials could help an attacker “gain insight into internal communications, as well as the process, methods and plans to distribute a Covid-19 vaccine,” IBM Security said in a statement.
As pharmaceutical companies and governments the world over prepare for the logistical puzzle of disseminating hundreds of millions of vaccines to help blunt the coronavirus, cyber-criminals continue to leverage the urgency and despair of the global pandemic for intelligence and monetary gain. In this case, the phishing scheme spanned six countries and targeted European organizations that bolster immunization in poor countries.
In late November, the Atlanta-based cold chain company Americold Realty Trust said it was the target of a cyber-attack. The company believes the attack has been contained, but hadn’t “completed its investigation,” Americold said in a Nov. 30 regulatory filing. The company didn’t expect the hack to impact operations.
Americold didn’t respond to requests for comment on the scope of the attack and the role email phishing may have played.
Covid-19 phishing emails are one of the most prolific scams in recent memory. Since late-January, attackers have duped recipients into opening emails with subject lines related to the virus. And victims the world over, living in fear of the pandemic and its economic impact, have opened these emails and clicked on their infected links and attachments. Doing so has led to compromises of individual devices and corporate networks, and ultimately to the theft of personal and company data. Employees working from home during the pandemic without sufficient cybersecurity protections have exacerbated these problems.
“As we shift toward distributing a vaccine for Covid-19, the logistics of this operation will become extremely critical,” said John Hultquist, a senior director at the cybersecurity firm FireEye Inc. “Seemingly mundane security issues could have major repercussions to such a complex and important effort.”
As Pfizer Inc. and Moderna Inc. work with U.S. and global regulators to approve their Covid-19 vaccines for emergency use, global distribution has already started. Pfizer and United Airlines transported the first mass air shipment of a vaccine from Brussels to Chicago in late November.
Pfizer’s vaccine must be stored at ultra-cold temperatures to avoid contamination. But maintaining temperature controls once a vaccine leaves the airplane remains a challenge. In parts of West Africa, for instance, temperatures in mid-December range from 70 to 90 degrees Fahrenheit. Even states in the U.S. lack necessary capacity to store large volumes of the vaccine without spoiling.
This makes cold chain companies like China’s Haier essential to global distribution. It also makes them prime targets for spoofing campaigns, said Claire Zaboeva, senior cyber threat analyst at IBM’s Security X-Force
Targets of the phishing operation have included the European Commission’s Directorate-General for Taxation and Customs Union, according to IBM. The agency is responsible for streamlining customs and duties as goods travel across the European Union. Attackers may see the agency as a single point of compromise to disrupt distribution across the region.
Petrochemical companies were also targeted, since they produce dry ice to keep vials cool.
“This was a well-prepared, precise, sophisticated campaign,” said Nick Rossmann, global lead for threat intelligence at IBM Security X-Force. “We can’t ignore the fact that there are actors who will benefit from disrupting distribution of the vaccine. If an actor could disrupt consumer trust in the vaccine, that could play a pivotal role in changing perceptions of world power.”
©2020 Bloomberg L.P.