CSIS Significant Cyber Incidents
CSIS entry 543 · November 2020
One Russian and two North Korean hacking groups launched attacks against seven companies involved in COVID-19 vaccine research.
Cerium targeting Covid-19 vaccine and treatment researchers (WHO-themed spear-phishing)
- Date (as written)
- 2020-11-13T13:59:58+00:00 (published_time)
- Year
- 2020
- Country
- Canada, France, India, South Korea and the United States (all three actors combined)
- Actors (as written)
- Cerium
- Actor pages
- CeriumZinc
- Tags (as written)
- sectors: pharmaceutical companies and vaccine researchers
Source entries (10)
CFR Cyber Operations Tracker
Cerium · Nov 2020
Hackers posing as World Health Organization officials in spear-phishing emails to steal credentials belonging to individuals involved in vaccine development.
CFR Cyber Operations Tracker
Targeting of companies involved in vaccine development · Nov 2020
North Korean hackers targeted at least six companies involved in the development of a COVID-19 vaccine. Masquerading as recruiters on WhatsApp and LinkedIn, the hackers used documents containing fake job descriptions to install malware on computers belonging to company staff.
CFR Cyber Operations Tracker
Targeting of vaccine researchers with fake job opportunities · Nov 2020
The North Korean threat group Zinc used spear-phishing emails to pose as job recruiters.
CFR Cyber Operations Tracker
Targeting of vaccine researchers with spear-phishing emails · Nov 2020
The North Korean threat group Cerium masqueraded as World Health Organization representatives in spear-phishing emails to victims.
CFR Cyber Operations Tracker
Zinc · Nov 2020
Hackers posing as recruiters in spear-phishing emails to steal credentials belonging to individuals involved in vaccine development.
Check Point Research
16th November - Threat Intelligence Bulletin · 2020-11-16
Nation-sponsored APT groups, including the infamous North Korean Lazarus Group and Russian FancyBear, have been targeting institutions involved with COVID-19 vaccine and treatment development. The most common tactic observed in this attack wave is spear-phishing using pandemic-related themes.
Hackmageddon cyber attacks timelines (Paolo Passeri)
At least seven prominent companies involved in COVID-19 vaccines research and treatments. · 13/11/2020
Microsoft says it detected three state-sponsored hacking operations that have launched cyber-attacks on at least seven prominent companies involved in COVID-19 vaccines research and treatments.
Microsoft On the Issues blog
Zinc targeting Covid-19 vaccine and treatment researchers (fake recruiter spear-phishing) · 2020-11-13T13:59:58+00:00 (published_time)
we’ve detected cyberattacks from three nation-state actors targeting seven prominent companies directly involved in researching vaccines and treatments for Covid-19. The targets include leading pharmaceutical companies and vaccine researchers in Canada, France, India, South Korea and the United States. The attacks came from Strontium, an actor originating from Russia, and two actors originating from North Korea that we call Zinc and Cerium. ... Zinc has primarily used spear-phishing lures for credential theft, sending messages with fabricated job descriptions pretending to be recruiters.
Microsoft On the Issues blog
Cerium targeting Covid-19 vaccine and treatment researchers (WHO-themed spear-phishing) · 2020-11-13T13:59:58+00:00 (published_time)
The attacks came from Strontium, an actor originating from Russia, and two actors originating from North Korea that we call Zinc and Cerium. ... Cerium engaged in spear-phishing email lures using Covid-19 themes while masquerading as World Health Organization representatives.
Values found later for empty fields
country: United States, Canada, France, India, and South Korea
Suspected victims: Pharmaceutical companies and vaccine researchers in the United States, Canada, France, India, and South Korea
actors: Zinc
The North Korean threat group Zinc used spear-phishing emails to pose as job recruiters.
actors: Cerium
Cerium ... Hackers posing as World Health Organization officials in spear-phishing emails to steal credentials belonging to individuals involved in vaccine development. ... Suspected state sponsor: Korea (Democratic People's Republic of)