Lalitgate: Cong questions PM's silence, says he too is liable

Several India-based firms are spoofing the World Health Organisation (WHO) by creating fake Gmail accounts and luring business leaders in disguise of informing them of latest COVID-19 announcements and hack their personal and financial information, Google has warned.

These "hack-for-hire" firms, many based in India, have been creating Gmail accounts spoofing the WHO, largely targeting business leaders in financial services, consulting, and healthcare corporations within numerous countries including, the US, Slovenia, Canada, India, Bahrain, Cyprus, and the UK.

"The lures themselves encourage individuals to sign up for direct notifications from the WHO to stay informed of COVID-19 related announcements, and link to attacker-hosted websites that bear a strong resemblance to the official WHO website," security researchers from Google's Threat Analysis Group said on Wednesday.

The sites typically feature fake login pages that prompt potential victims to give up their Google account credentials, and occasionally encourage individuals to give up other personal information, such as their phone numbers.

On any given day, Google's Threat Analysis Group (TAG) said it is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.

Last month, it sent 1,755 warnings to users whose accounts were targets of government-backed attackers.

"Our team of analysts and security experts is focused on identifying and stopping issues like phishing campaigns, zero-day vulnerabilities and hacking against Google, our products and our users," said the tech giant.

Google continues to see attacks from groups like Charming Kitten on medical and healthcare professionals, including WHO employees.

"We're seeing a resurgence in COVID-related hacking and phishing attempts from numerous commercial and government-backed attackers," said the company.

Government-backed or state-sponsored groups have different goals in carrying out their attacks: Some are looking to collect intelligence or steal intellectual property; others are targeting dissidents or activists, or attempting to engage in coordinated influence operations and disinformation campaigns.

Google said that since March, it has removed more than 1,000 YouTube channels that were part of a large campaign and behaving in a coordinated manner.

"These channels were mostly uploading spammy, non-political content, but a small subset posted primarily Chinese-language political content similar to the findings of a recent Graphika report," said the company.

Several cybersecurity firms have seen a spike in COVID-19 related scams and hacking attempts. Hackers are also creating scam sites similar to COVID-19 relief packages.

Researchers at Check Point Software Technologies revealed in mid-May that they have seen 192,000 coronavirus-related cyber-attacks per week over the past three weeks, a 30 % increase compared to previous weeks.

New Delhi, Apr 28: With 1,594 new cases of COVID-19 reported in the last 24 hours and 51 deaths, India's total count of coronavirus cases surged to 29,974, said the Union Ministry of Health and Family Welfare on Tuesday.

The total cases are inclusive of 7,026 cured and discharged patients, one migrated and 937 deaths.

At present, there are 22,010 active COVID-19 cases in the country.

Addressing a press conference here, Lav Agarwal, Joint Secretary, Union Health and Family Welfare Ministry, said that in the last 28 days, 17 districts have had no new Covid-19 cases. "This means we need to maintain constant vigil," he added.

Bengaluru, May 21: The COVID-19-induced lockdown saw a spurt in crybercrimes in India with Kerala recording the highest number during the period, according to an analysis of IT security solutions provider K7 Computing.

The report analyses various cyberattacks within India during the pandemic and reveals that threat actors targeted the States with COVID-19-themed attacks aimed at exploiting user trust.

The sudden surge in the frequency of attacks witnessed from February 2020 to mid-April 2020 indicates that scamsters across the world were exploiting the widespread panic around coronavirus at both the individual and corporate level, the company said in a statement.

These attacks aimed to compromise computers and mobile devices to gain access to users confidential data, banking details and cryptocurrency accounts.

The key threats seen during this period ranged from phishing attacks to rogue apps disguised as COVID-19 information apps that targeted users sensitive data.

Phishing attacks were noticed more in Tier-II and Tier-III cities while the metros fared better.

Smaller cities saw over 250 attacks being blocked per 10,000 users.

Users from Ghaziabad and Lucknow seem to have faced almost six and four times the number of attacks, respectively, as Bengaluru users.

In Kerala, regions like Kottayam, Kannur, Kollam, and Kochi saw the highest hits with 462, 374, 236, and 147 attacks respectively, while the state as a whole saw around 2,000 attacks during the period, the highest thus far in the country.

This was followed by Punjab with 207 attacks and Tamil Nadu at 184 attacks, the statement said.

A majority of the recorded attacks were phishing attacks with sophisticated campaigns that could easily snare even the most educated users, it said.

These attacks were aimed at heightening users fears and creating a sense of urgency to take action.

The report noted phishing attacks where scamsters posed as representatives of the United States Department of the Treasury, the World Health Organisation, and the Centres for Disease Control and Prevention.

Users were encouraged to visit links that would automatically download malware on the host computer such as the Agent Tesla keylogger or Lokibot information-stealing malware, infamous banking Trojans such as Trickbot or Zeus Sphinx, and even disastrous ransomware.

Other attacks included infected COVID-19 Android apps like CoronaSafetyMask that scam users with promises of masks for an upfront payment; the spyware app Project Spy; and seemingly genuine apps that are infected with dangerous malware like banking Trojans such as Ginp, Anubis and Cerberus, it was stated.