Hackers target global vaccine delivery plan
BOSTON — IBM security researchers say they have detected a cyberespionage effort using targeted phishing emails to try to collect vital information on the World Health Organization’s initiative for distributing COVID- 19 vaccine to developing countries.
The researchers said they could not be sure who was behind the campaign, which began in September, or if it was successful. But the precision targeting and careful efforts to leave no tracks bore “the potential hallmarks of nationstate tradecraft,” the researchers said in a blog post Thursday.
The campaign’s targets, in countries and territories including Germany, Italy, South Korea and Taiwan, are probably associated with the development of the “cold chain” needed to ensure that COVID- 19 vaccines get the nonstop sterile refrigeration they need to be effective for the nearly 3 billion people who live in places where temperature- controlled storage is insufficient, IBM said.
“Think of it as the bloodline that will be supplying the most vital vaccines globally,” said Claire Zaboeva, an IBM analyst involved in the detection.
Whoever is behind the operation could be motivated by a desire to learn how the vaccines are best able to be shipped and stored — the entire refrigeration process — in order to copy it, said Nick Rossmann, the IBM team’s global threat intelligence lead. Or they might want to be able to undermine a vaccine’s legitimacy or launch a disruptive or destructive attack, he said.
In the ploy, executives with groups probably associated with the initiative known as Covax — created by the Gavi vaccine alliance, the World Health Organization and other United Nations agencies — were sent spoofed emails appearing to come from an executive of Haier Biomedical, a Chinese company that’s considered the world’s main cold- chain supplier, the analyst said.
The phishing emails had malicious attachments that prompted recipients to enter credentials that could have been used to harvest sensitive information about partners vital to the vaccine delivery platform.
Targets included the European Commission’s Directorate- General for Taxation and Customs Union and companies that make solar panels for powering portable vaccine refrigerators. Other targets were petrochemical companies, probably because they produce dry ice, which is used in the cold chain, Zaboeva said.
The EU agency has been busy revising new import and export regimens for COVID- 19 vaccines and would be a gold mine for hackers seeking stepping stones into partnering organizations, she said.
Covax has struggled to raise enough money to compete for vaccine contracts against the world’s wealthiest nations in the race to secure doses as fast as they can be produced. But the U. N. and Gavi have invested millions in cold- chain equipment across Africa and Asia. The investment, in the works well before the pandemic, was accelerated to prepare for an eventual global rollout of COVID- 19 vaccines.
Whoever was behind the phishing operation probably sought “advanced insight into the purchase and movement of a vaccine that can impact life and the global economy,” the blog post said. COVID- 19 vaccines will be one of the world’s most sought- after products as they are distributed, so theft may also be a danger.