ANALYSIS OF ATTACKS USED BY CYBER CRIMINALS DURING COVID 19

Abstract

According to the World Health Organization, a pandemic is
defined as "the spread of a new disease throughout the
world." From a cybersecurity perspective, this means disaster. During disasters, the number of cybercriminals grows
every day. As more and more highly qualified cybersecurity
professionals join the blue team, more and more malicious
applications are launched daily, with an estimated 230,000
new malware samples per day, according to researchers at
PandaLabs. A pandemic can be viewed as an event that can
lead to the fulfillment of business continuity plans or the
implementation of disaster recovery measures. During this
time, the growing number of cybersecurity threats should
be analyzed and the applicable security measures determined. There are also considermany administrative information security issues. This article covers the main issues of
infrastructure monitoring, as well as ensuring a high level of
vulnerability management and incident response. Presented
the management measures that must be used in SOC centers, as well as an in-depth analysis of attack vectors and
security measures that can be applied to prevent them. A
presented attack via Zoom conferencing software that describes the possible attack vector used by a threat actor to
compromise an organization through unprotected users.
When malware is provided under the user's legitimate pseudonym, other users can download it and install it on their
assets. It has been determined that the first control that can
be applied to avoid social engineering attacks is informative
sessions or training sessions that contain examples of fake
COVID 19 resources and the second could be the inclusion
of phishing detection and email malware scanning modules
in the endpoint security software and in the settings of the
e-mail delivery system. It has been determined that remote
security monitoring should focus on analyzing events from
endpoints with host intrusion detection systems, endpoint
detection and response solutions, and endpoint security
software that allows remote control and aggregation of
events across center console. In addition, security analysts
should pay attention to events and logs from the organization's services and cloud infrastructure assets.