Hackers Using Zoom’s Popularity in Coronavirus Outbreak to Infect Computers With Malware

Cybercriminals continue to use the Coronavirus outbreak to launch various attacks such as malware, phishing, fraud, and disinformation campaigns.

In the current situation, most of the organization has been closed and the employees are provided with options to work from home. So the RDP and the video communication platforms usage will be high.

Zoom-bombing Attack

The number of the domain registered based on the coronavirus has already a huge uptick, since the outbreak has become more widespread.

It was observed more than 5000+ domains registered for creating infrastructure to support malicious campaigns referring to COVID-19.

Checkpoint observed a huge number of domain’s registered with the names that include “Zoom”, the Zoom is one of the biggest video communication platform used in the world.

“Since the beginning of the year, more than 1700 new domains were registered and 25% of them were registered in the past week. Out of these registered domains, 4% have been found to contain suspicious characteristics.”

Zoom is not only the target, but attackers also registered phishing domains mimic various services such as classroom[.]google.com, googloclassroom[.]com, and googieclassroom[.]com.

Also, checkpoint observed malicious files such as zoom-us-zoom_##########.exe” and “microsoft-teams_V#mu#D_##########.exe” which leads to the installation of the malware.

FBI also warned users to stay awake in the COVID-19 crisis as the video-teleconferencing (VTC) hijacking emerges.

They observed an incident in which “a Massachusetts-based high school reported that while a teacher was conducting an online class using the teleconferencing software Zoom, an unidentified individual(s) dialed into the classroom. This individual yelled profanity and then shouted the teacher’s home address in the middle of an instruction.”

Users are recommended not to make the meetings public or don’t share the meeting links in social media and make sure that your meetings have a password enabled.