Cybercriminals are taking advantage of the coronavirus crisis to sell everything from masks and ventilators to a way to take over a political website for the purposes of 'raising panic'

While the rest of the world seeks to avoid the virus, there is a demand for it on the dark web.

DarkOwl cites numerous scammers offering samples of the COVID-19 virus via blood samples and saliva. A listing from March 31 "attempted to imbue legitimacy into their listing, stating that they were a 'laboratory doctor in Spanish public health' who successfully obtained "24 blood samples and infected sputum of the new COVID-19'," DarkOwl writes in its new report.

Another ad found by DarkOwl stated the seller's father was infected with COVID-19 and while at the hospital the seller managed to collect blood. DarkOwl says it found a separate listing that pitched the live virus as "great for the coworker you don't like. Or spread it in the ghetto if you're like that or maybe let it loose at the country club."

News of Israel making progress on a COVID-19 vaccine prompted a slew of postings offering supposed cures early, IntSights reports. The most believable vaccine ads range from detailed listings citing specific Israeli research labs, the origin of the vaccine, and a price of $115. The most questionable, shown here, offers 10 vials for $10. 

In another marketplace, an ad promotes saliva from an infected person that could supposedly help build immunity against the virus.

Meanwhile, IntSights reports ransomware groups targeted HMR, a company helping to develop tests and vaccines for COVID-19. 

Researchers have found a booming black market of listings of items related to COVID-19 for sale. "Profiteering and scams include hoarding and selling items in high-demand. Some, presumably, claim to be selling such items and take the money without providing any goods," Sixgill cybersecurity writes in its recent report. "While we could not locate anyone selling truckloads of toilet paper (we searched), we did find, more insidiously, actors seeking to hoard or sell medical items such as ventilators, masks, and testing kits."

Ventilators have been precious items in the life-and-death fight against the virus in hospitals, especially in New York City. The desperation to find more of the machines has driven dark web scams, researchers say. 

The cybersecurity company Sixgill found this exchange in a dark web forum in which a hacker was handing out access to real Zoom videoconferencing accounts. Zoom has seen use of its platform skyrocket during the boom of remote work during the virus – but has also seen a spike in security issues. 

In a recent report, Sixgill said there has been a boom in scammers posing as other people during the virus, and found dark web mentions of social engineering within the context of coronavirus rose eightfold in March.

Sixgill says monitoring the criminal underground is important: "We must caution that the dark web is a testing ground of malign ideas; if an actor shares a 'success story' of how he made money, many copycat attacks should be expected in the immediate future." 

Researchers found all types of masks are for sale on the dark web, including the N95 respirator type in high demand. DarkOwl's report found this listing for N95 masks in packs of 10 for €80 ($87).

DarkOwl also found groups selling N95 masks and listing their certified expiration dates, and selling designs for 3D printing protective face shields.

In its report on dark web virus postings, Sixgill found a profiteer who wrote: "I'm looking to order huge quantities: 10 million pieces. It's very hard to find direct supplier cause of large demand."  

Medical professionals have been desperate for masks to protect them while they work throughout the virus outbreak. 

"Threat actors all over the world are exploiting people's fears around COVID-19 in order to make money," the cybersecurity firm Intsights wrote in its report. This ransomware letter tells the victim "I could even infect your whole family with the Coronavirus" if payment wasn't made.

"These types of fear tactics work on a vulnerable population of people during a frightening pandemic," Intsights wrote. "Threat actors use these fear tactics because they work."

Intsights also cited a ransomware attack of HMR, a UK company that has recently taken an active role in developing tests and vaccines for COVID-19. The company was attacked on March 14th, with medical records of over 2,300 patients and employees leaked.

The economic stimulus package to help businesses and citizens rebound from the virus crisis spells opportunity for fraudsters in the criminal underground, Sixgill found. "In times of crisis, government funding and aid money is readily available, sometimes without the regular procedures and precautions that normally exist to prevent fraud. Malicious actors seek to take advantage of this."

On the dark web, Sixgill has observed several discussions between users regarding how to acquire federal business loan money. The users don't appear to be in the US, due to their conversion of dollars to euros. 

"The Federal Government provides around half a trillion (that's $500 billion) euros for companies and entrepreneurs financially damaged and at risk. Fast and unbureaucratic. It can be assumed that there will be a real flood of applications. So the question is, how do we cut a few slices off it?" 

In one of the most unusual finds of recent dark web analysis, researchers from Sixgill found a post in which an actor claims to be auctioning access to the cloud platform of a top-200, politically themed US website. The actor notes that the site would be "great for raising panic about the coronavirus." The auction began at $20,000.

Another company, Intsight, found other forms of political chaos for sale including the "spread of disinformation by state-sponsored operations to create dissent and disrupt world markets, elections, and authorities. Politicians and militaries alike are employing psychological operations on adversary populations to cause conflict, division, and dissent around this pandemic." Russia, North Korea, China, and Pakistan are the most frequent offenders, Intsight says in its report. 

And DarkOwl found one bad actor who spread misinformation, much of it about COVID-19, to 76,000 different web pages. 

Many users on the dark web "discuss stockpiling weapons and ammunition," Sixgill says in its report. This listing from a virtual store purported to be selling "guns, military items, and explosives," implied that there is a backlog on orders because of the
coronavirus:

"Please be patient, as the coronavirus is affecting everything," the proprietor says. 

Sixgill noted in its report that many discussions on the dark web "focus on how individuals are preparing for the virus. This includes individuals relating amassing food and other necessities."