FBI FLASH: COVID-19 Phishing Email Indicators

The FBI has published a TLP:WHITE FLASH message providing indicators of COVID-19 phishing emails to assist in network defense. The FBI advises that cyber criminals, who include advanced persistent threat (APT) groups, have crafted COVID-19-themed health, informational, and warning notice emails in an attempt to obtain online service credentials, such as those for Microsoft Office 365 accounts. Additionally, cyber criminals have attached archive files that contain malicious portable executables (PE) or JAVA.jar files to their phishing emails. In addition to providing the indicators of these phishing emails, the FLASH includes recommended mitigation measures. It also encourages anyone who observes the activity to report it to the FBI.