Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Most Malicious Coronavirus-Related Domains Located in U.S.

The United States has the highest number of malicious domains with names associated with the current coronavirus crisis, a new report reveals.

The United States has the highest number of malicious domains with names associated with the current coronavirus crisis, a new report reveals.

With the mandatory social distancing rules forcing employees all around the world to work from home, cybercriminals were quick to adapt to the situation and repurpose their attacks. By mid-April, Google was reporting over 18 million COVID-19-themed malware and phishing emails being sent out every day.

Now, Palo Alto Networks’ security researchers say they have identified over 86,600 risky or malicious domains out of 1.2 million domain names registered between March 9 and April 26 that contain keywords related to the COVID-19 pandemic.

On average, just over 1,760 malicious COVID-19-themed domains were created each day during the analysis period, Palo Alto Networks says. The domains covered in the research are those that include keywords such as “coronav”, “covid”, “ncov”, “pandemic”, “vaccine” and “virus.”

Most of the risky or malicious domains (29,007) are located in the United States, followed by Italy (2,877), Germany (2,564), and Russia (2,456). Most of the domains (79.8%) were used for malware, with phishing (20%) and command and control (0.2%) domains also observed.

COVID-19-related domains

More than 56,200 of the newly registered domains were hosted by one of the top four cloud service providers (CSPs): 70.1% (39,494) on Amazon Web Services (AWS), 24.6% on Google Cloud Platform (GCP), 5.3% on Microsoft Azure, and 0.1% on Alibaba Cloud.

Of the 86,600 risky or malicious domains, 2,829 were hosted in public clouds: 79.2% on AWS, 14.6% on GCP, 5.9% on Azure, and 0.3% on Alibaba. By leveraging cloud resources, threat actors can not only evade detection, but also amplify attacks.

In an April 1 report, Cisco revealed that around 4% of the roughly 47,000 domains that included the word “covid” or “corona” were malicious. In addition to “corona”, “virus”, and “covid”, other popular keywords at the time included “wuhan”, “clinics”, “lab”, “tests”, “selftestkit”, “purchase kits” and “helpline”.

Advertisement. Scroll to continue reading.

Palo Alto Networks researchers also discovered that some of the malicious domains would resolve to multiple IP addresses, while some IP addresses were being used for multiple domains.

“This many-to-many mapping often occurs in cloud environments due to the use of content delivery networks (CDNs) and can make IP-based firewalls ineffective,” they explained. “A blacklisted IP in a layer-3 firewall may fail to block the traffic to/from a malicious domain while unintentionally making many other benign domains unreachable.”

The COVID-19 pandemic also resulted in an increase in cloud adoption, with threats both originating from the cloud and targeting cloud users. As Europol pointed out last week, cyber-attacks, fraud schemes and other activities targeting regular users are expected to continue in the long term.

“With thousands of malicious domains coming online every day, it is imperative to protect every endpoint with continuous monitoring and automatic threat prevention tools. However, cloud-hosted services or applications usually give users less visibility and make network monitoring more challenging,” Palo Alto Networks concludes.

Related: Criminals Quick to Exploit COVID-19 Crisis in Europe

Related: Google Sees Millions of COVID-19-Related Malicious Emails Daily

Related: Vietnamese Hackers Mount COVID-19 Espionage Campaigns Against China

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.