Nation-state backed hackers going after COVID vaccine supply chain
Patrick December 3, 2020
Enlarge / A climate controlled thermo haulage truck trailer outside the Pfizer Inc. facility in Puurs, Belgium, on Thursday, Dec. 3, 2020.
Bloomberg | Getty Images
Cyber attackers have targeted the cold supply chain needed to deliver COVID-19 vaccines, according to a report detailing a sophisticated operation likely backed by a nation-state.
The hackers appeared to be trying to disrupt or steal information about the vital processes to keep vaccines cold as they travel from factories to hospitals and doctors' offices.
According to the report by IBM's threat intelligence task force, which advises companies and the public sector on cyber security, they targeted organizations associated with a cold chain platform run by the Gavi vaccine alliance, a public-private partnership for developing immunization for poorer countries.
Many of the COVID-19 vaccines have to be kept cold to keep them from spoiling. Pfizer and BioNTech's vaccine must be kept between minus 70C and minus 80C, while Moderna's shot needs to be transported at minus 20C.
The attackers pretended to be an executive at a Chinese supplier of ultra-cold refrigeration to mount a phishing campaign trying to obtain usernames and passwords, the report said.
Nick Rossmann, IBM's global lead for threat intelligence, said he believed the hackers were either looking to disrupt the vaccine delivery process or steal intellectual property.
"One side of it is cyber espionage: How do you get vaccines out? How is the manufacturing process working for refrigeration? How are you managing the entire logistics chain?" he said. "There's also potential for disruption, being able to launch attacks that disrupt vaccines, and their distribution to undermine trust in them around the world."
He added that it was vital to treat the vaccine supply chain as "a new type of global critical infrastructure" to help them secure the products that could help end the pandemic.
"These refrigeration companies are not going to have the same security tools that advanced financial institutions have," he said.
The news prompted the US cyber agency on Wednesday to issue a formal alert to other groups involved in the cold supply chain.
Claire Zaboeva, senior strategic cyber threat analyst at IBM, said it could be the "tip of an iceberg" in a larger global campaign, as the hackers try to find holes in security and jump between companies and governments involved in the mass vaccination programs.
"It was an extremely well-researched and well-placed campaign. And that does potentially point to a very competent person or team," she said.
The IBM report described a hacking campaign that spanned six countries, aimed at the European Commission's customs and taxation unit, and organizations in energy, manufacturing and technology. The campaign started in September and the task force discovered the threat in October.
The IBM researchers do not know if the hackers were successful at gaining entry to the networks.
"Today's report highlights the importance of cyber security diligence at each step in the vaccine supply chain," said Josh Corman, the Cybersecurity and Infrastructure Security Agency's chief strategist for healthcare.
The FBI has been notified of the attacks. The Gavi vaccine alliance said it had "strong policies and processes in place to prevent such phishing attacks and hacking attempts" and that it would continue to strengthen its security.
The European Commission said it was aware of the campaign and had taken "necessary steps" to mitigate the attack. It added that it takes cyber security seriously and investigates every incident.
Additional reporting by Kadhim Shubber in Washington DC.
© 2020 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.
Samsung begins rollout of Android 11 and One UI 3.0 to latest phones
Thu Dec 3 , 2020
Samsung is starting to roll out updates to Android 11 and One UI 3.0, its customized interface, to some of its latest phones. The first up are Galaxy S20 series devices in the US, Korea, and most of Europe, which will start receiving updates today. Updates for the Note 20, […]
Report: Microsoft is again planning Android app support for Windows 10
Alphabet's Sidewalk Labs scraps its ambitious Toronto project
Patrick May 9, 2020
Valorant closed beta: The tactical hero shooter I never knew I wanted
Tesla will cash in on surging stock price with $5 billion stock sale
Patrick September 1, 2020
AOC makes explosive Twitch debut with over 435,000 Among Us viewers
Patrick October 21, 2020
Astronomers have finally measured the distance of first observed Einstein ring
Patrick June 8, 2020