IBM: Hackers are targeting COVID-19 vaccine 'cold chain'

A gloved medical employee conducting research on COVID-19
(Image credit: Shutterstock)

A global phishing campaign is targeting organisations working to ensure the temperature-controlled storage and transportation of the COVID-19 vaccine, otherwise known as the cold chain.

The phishing campaign, which was uncovered by IBM security researchers, was reported to have begun in September 2020. Spanning across six countries, it targeted organisations associated with Gavi, The Vaccine Alliance’s Cold Chain Equipment Optimization Platform (CCEOP) programme.

Cyber criminals were found to have sent phishing emails under the name of a business executive from Haier Biomedical, a credible and legitimate member company of the COVID-19 vaccine supply chain as well as a qualified supplier for the CCEOP programme.

In a likely attempt to harvest credentials and potentially gain access to corporate networks and sensitive information, the hackers addressed the emails to organisations believed to hold sensitive information relating to COVID-19 vaccine distribution.

According to IBM Security X-Force, targets included organisations within the energy, manufacturing, website creation, and internet security industries across Germany, Italy, South Korea, Czech Republic and Taiwan, as well as the European Commission’s Directorate-General for Taxation and Customs Union.

In a blog post explaining the findings, IBM’s senior strategic cyber threat analyst Claire Zaboeva said that the “spear-phishing emails were sent to select executives in sales, procurement, information technology and finance positions, likely involved in company efforts to support a vaccine cold chain”.

“We also identified instances where this activity extended organisation-wide to include help and support pages of targeted organisations,” she added.

However, the identity of the cyber criminals remains unknown. IBM Security X-Force believes that “the precision targeting and nature of the specific targeted organisations” could signify that the hackers were potentially state-sponsored.

Last month, Microsoft warned that pharmaceutical companies researching treatments and vaccines for COVID-19 are being actively targeted by prominent nation state-backed hackers from Russia and North Korea.

The attempts to disrupt vaccine trials and distribution are only a small portion of an overall threat escalation that many organisations and businesses have sustained during 2020, with over a quarter of all security incidents in the last year being related to COVID-19.

Following the discovery, IBM Security X-Force had followed responsible disclosure protocols as well as notified the appropriate entities and authorities about the phishing campaign.

Sabina Weston

Having only graduated from City University in 2019, Sabina has already demonstrated her abilities as a keen writer and effective journalist. Currently a content writer for Drapers, Sabina spent a number of years writing for ITPro, specialising in networking and telecommunications, as well as charting the efforts of technology companies to improve their inclusion and diversity strategies, a topic close to her heart.

Sabina has also held a number of editorial roles at Harper's Bazaar, Cube Collective, and HighClouds.