Exploiting COVID-19: how threat actors hijacked a pandemic

Thursday 29 September 2022, 11:30 - 12:00, Red room

Selena Larson (Proofpoint)
Daniel Blackford (Proofpoint)

The global relevance of the COVID-19 pandemic created an environment primed for exploitation like none witnessed in the age of the cybercriminal. Adversaries of every sophistication level — advanced state-aligned groups, large and small-scale crime-motivated actors, scammers and spammers of every variety — all pivoted to make use of COVID-19 related content for their respective nefarious ends.


Now in our third year living with COVID-19, we can look back and identify some key phases global societies moved through. Initial periods required a great deal of dissemination of policy changes across a broad spectrum of organizations including both country and local-level mandates as well as business-related guidelines. Lockdown, economic stimulus, vaccine development and eventual deployment, the rise of variants creating new surges of illness ... all of these stages provided threat actors with the content needed to exploit the human condition and earn clicks.

In this paper, we will present the following:

• How cybercrime and APT actors leveraged the COVID-19 pandemic in social engineering activity
• How activity changed throughout the lifecycle of the global pandemic
• What social engineering tactics were most effective What we can learn from threat actor behaviors to defend ourselves moving forward

This paper examines the wide array of COVID-19 related content threat actors have leveraged, how that use evolved alongside real-world conditions, and how it fits into the overall picture of the threat landscape since the beginning of 2020.

• Download paper for this talk
• Dowload slides for this talk

Selena Larson Selena Larson is a senior threat intelligence analyst at Proofpoint on the Threat Research team. She collaborates with fellow researchers to identify and investigate advanced threats and develop actionable threat intelligence. Previously, she was a cyber threat analyst for the industrial cybersecurity firm Dragos, and a cybersecurity and privacy journalist.

Daniel Blackford Daniel Blackford is a senior threat researcher at Proofpoint and as such tracks the various actors and TTPs that comprise the threat landscape. He spends his days hunting through massive amounts of mailflow and cloud data to identify malicious activity in order to surface and provide context for those threats both directly to clients as well as through tools such as TAP. Prior to his work at Proofpoint, Daniel worked as a malware analyst at the National Cyber Forensics and Training Alliance (NCFTA), and as a combat engineer in the US Army. Daniel has a B.S. in computer science from the University of Pittsburgh. Hail to Pitt.

Back to VB2022 Programme page

Other VB2022 papers