IBM: Hackers are targeting COVID-19 vaccine 'cold chain'

A phishing campaign targeted organisations that held sensitive information relating to COVID-19 vaccine distribution

A global phishing campaign is targeting organisations working to ensure the temperature-controlled storage and transportation of the COVID-19 vaccine, otherwise known as the cold chain.

The phishing campaign, which was uncovered by IBM security researchers, was reported to have begun in September 2020. Spanning across six countries, it targeted organisations associated with Gavi, The Vaccine Alliance’s Cold Chain Equipment Optimization Platform (CCEOP) programme.

Cyber criminals were found to have sent phishing emails under the name of a business executive from Haier Biomedical, a credible and legitimate member company of the COVID-19 vaccine supply chain as well as a qualified supplier for the CCEOP programme.

In a likely attempt to harvest credentials and potentially gain access to corporate networks and sensitive information, the hackers addressed the emails to organisations believed to hold sensitive information relating to COVID-19 vaccine distribution.

According to IBM Security X-Force, targets included organisations within the energy, manufacturing, website creation, and internet security industries across Germany, Italy, South Korea, Czech Republic and Taiwan, as well as the European Commission’s Directorate-General for Taxation and Customs Union.

In a blog post explaining the findings, IBM’s senior strategic cyber threat analyst Claire Zaboeva said that the “spear-phishing emails were sent to select executives in sales, procurement, information technology and finance positions, likely involved in company efforts to support a vaccine cold chain”. 

“We also identified instances where this activity extended organisation-wide to include help and support pages of targeted organisations,” she added.

However, the identity of the cyber criminals remains unknown. IBM Security X-Force believes that “the precision targeting and nature of the specific targeted organisations” could signify that the hackers were potentially state-sponsored.

Last month, Microsoft warned that pharmaceutical companies researching treatments and vaccines for COVID-19 are being actively targeted by prominent nation state-backed hackers from Russia and North Korea.

The attempts to disrupt vaccine trials and distribution are only a small portion of an overall threat escalation that many organisations and businesses have sustained during 2020, with over a quarter of all security incidents in the last year being related to COVID-19. 

Following the discovery, IBM Security X-Force had followed responsible disclosure protocols as well as notified the appropriate entities and authorities about the phishing campaign.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Security best practices for PostgreSQL

Securing data with PostgreSQL

Download now

Transform your MSP business into a money-making machine

Benefits and challenges of a recurring revenue model

Download now

The care and feeding of cloud

How to support cloud infrastructure post-migration

Watch now

Recommended

Hackers leak data from dark web marketplace
cyber security

Hackers leak data from dark web marketplace

9 Apr 2021
How to encrypt files and folders in Windows 10
encryption

How to encrypt files and folders in Windows 10

9 Apr 2021
The definitive guide to IT security
Whitepaper

The definitive guide to IT security

9 Apr 2021
Evidence suggests REvil behind Harris Federation ransomware attack
ransomware

Evidence suggests REvil behind Harris Federation ransomware attack

9 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
Hackers are using fake messages to break into WhatsApp accounts
instant messaging (IM)

Hackers are using fake messages to break into WhatsApp accounts

8 Apr 2021
Data belonging to 500 million LinkedIn users found for sale on hacker marketplace
hacking

Data belonging to 500 million LinkedIn users found for sale on hacker marketplace

8 Apr 2021