Wine scams spiked during COVID

The malicious wine-related activity "must be stopped at all costs."

Absolute monsters.

Wine-themed domain registrations rose once COVID-19 lockdowns took hold, some of them malicious and used in phishing campaigns, Recorded Future and Area 1 Security said in a joint report out Wednesday.

“As the interest in virtual happy hours and get-togethers increased so did the increase in wine-themed domain registrations,” the report states.

Amid the COVID outbreak, alcohol has proven itself a target for hackers — but it hasn’t been clear before that scammers were trying to exploit people who were staying home and imbibing more. Alcohol delivery service Drizly, for instance, suffered a breach in July, while ransomware hit liquor and wine maker Brown-Forman around the same time.

Recorded Future observed a mild jump in wine domain registrations in March of 2020, from the usual 3,000 to 4,000 per month up to nearly 5,500. April saw a bigger leap, to almost 7,200, and the numbers took off in May to 12,400. They’ve stayed high ever since.

Domains that Recorded Future labeled as malicious followed a similar pattern. Researchers found 278 domains in April of 2020, followed by 668 in May. They began leveling off by fall, however.

“It appears that it took some time for cyber criminals to catch on to the idea of using wine in malicious activities,” the report says. “Tracking malicious wine-themed domains as a percentage of total wine domains registered shows that the peak as a percentage of total wine-themed domains was in June 2020 at 7%.”

That’s when Area 1 Security tagged in: It analyzed the above domains being used in email campaigns. The company determined the majority of the 25,000 emails were spam, but 13.5% contained suspicious or malicious links or files and 11.7% were business email compromise phishing emails.

“Overall, these results show that spam and phishing campaigns are aware of the growing interest in wine and are using that interest to push malicious activity,” the report reads.

Allan Liska, an analyst at Recorded Future, said that, as a wine lover, he subscribes to a lot of wine mailing lists and began to see some low-level spam messages, prompting him to investigate further.

He said he suspects that studying “happy hour”-themed registrations would turn up similar results.

“Scammers and attackers always jump on the latest trends, so part of this is just natural progression: they see increased interest in wine and they want to take advantage of the situation,” Liska said.

And he quipped: “I also take this increased malicious activity as a personal attack against me, one that must be stopped at all costs.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure