The FBI is investigating the targeting and compromise of U.S. organizations conducting COVID-19-related research by PRC-affiliated cyber actors and non-traditional collectors. These actors have been observed attempting to identify and illicitly obtain valuable intellectual property (IP) and public health data related to vaccines, treatments, and testing from networks and personnel affiliated with COVID-19-related research.
The potential theft of this information jeopardizes the delivery of secure, effective, and efficient treatment options. The FBI and CISA urge all organizations conducting research in these areas to maintain dedicated cybersecurity and insider threat practices to prevent surreptitious review or theft of COVID-19-related material.
FBI is responsible for protecting the U.S. against foreign intelligence, espionage, and cyber operations, among other responsibilities. CISA is responsible for protecting the nation’s critical infrastructure from physical and cyber threats. CISA is providing services and information to support the cybersecurity of federal and state/local/tribal/territorial entities and private sector entities that play a critical role in COVID-19 research and response.
Recommendations:
* Assume that press attention affiliating your organization with COVID-19-related research will lead to increased interest and cyber activity.
* Patch
all systems for critical vulnerabilities, prioritizing timely patching for
known vulnerabilities of internet-connected servers and software processing
internet data.
* Actively
scan web applications for unauthorized access, modification, or anomalous
activities.
* Improve
credential requirements and require multi-factor authentication.
* Identify
and suspend access of users exhibiting unusual activity.
* Victim
Reporting and Additional Information
The FBI encourages victims to report information concerning suspicious or criminal activity to their local field office. For additional assistance and best practices, such as cyber hygiene vulnerability scanning, please visit cisa.gov/coronavirus.
The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) issued a public service announcement today warning organizations researching COVID-19 of likely targeting and network compromise by the People’s Republic of China (PRC). Health care, pharmaceutical, and research sectors working on COVID-19 response should all be aware they are the prime targets of this activity and take the necessary steps to protect their systems.
China’s efforts to target these sectors pose a significant threat to our nation’s response to COVID-19. This announcement is intended to raise awareness for research institutions and the American public and provide resources and guidance for those who may be targeted.
The FBI requests organizations who suspect suspicious activity contact their local FBI field office. CISA is asking for all organizations supporting the COVID-19 response to partner with the agency in order to help protect these critical response efforts.
Additional technical details regarding the threat will be released in the coming days. CISA and the United Kingdom’s National Cyber Security Agency released a similar alert earlier this month warning of malicious actors targeting COVID-19 response organizations using a tactic of password spraying.
