Cybercriminals Deploy Pandemic and Vaccine Themes to Target Banks, Cryptocurrency Exchanges in SEA – Part One

In a virtual media conference, global cybersecurity company Kaspersky unmasked the latest cyberthreats banking and financial services industry should be on guard against, as the pandemic continues in Southeast Asia (SEA). 

Kaspersky’s cybersecurity expert noted the main trends witnessed in the cyberspace last year, and will continue in 2021. These include the abuse of COVID-19 theme, the exploit of researches related to the pandemic, and the scams and misinformation about the virus and the vaccines.

“It is becoming clear that these threat actors will keep on using topics related with the pandemic to trick the human mind. While vaccines are here, the situation continues to be uncertain. Countries are still implementing lockdowns, virtual learning and working are both here to stay, and digital payments are on the rise. This means IT infrastructure remains outstretched, further opening loopholes for threats targeting beyond Windows and internet-facing network devices as well as multi-platform and supply chain attacks,” reveals Park, Senior Security Researcher, Global Research and Analysis Team (GReAT) at Kaspersky.

As of last year, more than 80,000 COVID-related domain connections and malicious websites were detected by Kaspersky in SEA alone. Malaysia registered the highest number followed by Vietnam, the Philippines, and Indonesia.

This trend is expected to continue until 2021 as the region continues its battle against the pandemic and rolls out vaccines in different phases.

Cybercrime groups targeting banks, cryptocurrency exchanges in Southeast Asia

Banks remain charming targets for cyber adversaries. In fact, data from Kaspersky’s GReAT revealed banks and financial institutions were second and third most targeted sectors last year, globally. 

One of the campaigns singling out banks in SEA is JsOutProx malware. Even though this malware is currently not a highly sophisticated strain, Kaspersky experts noted its continued attempts to infiltrate banks in the region. 

The cybercriminals behind this module malware exploit file names associated with bank-related businesses and use heavily obfuscated script files, an anti-evasion tactic. This social engineering technique particularly preys on bank employees to get inside the institution’s network. 

Once in, Park shares that “JSOutProx can load more plugins to perform malicious acts against its victims including remote access, data exfiltration, command and control (C2) server takeover, and more.”