Skip to main content

People’s Republic of China Targeting COVID-19 Research Organizations  

Health-ISAC Threat Bulletin

May 13, 2020

TLP-White

Event: People’s Republic of China (PRC) Targeting of COVID-19 Research Organizations

Summary:

On May 13, 2020, the Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) issued an announcement to raise awareness of the threat to COVID-19-related research. The FBI is investigating the targeting and compromise of U.S. organizations conducting COVID-19-related research by PRC-affiliated cyber actors and non-traditional collectors.

These actors have been observed attempting to identify and illicitly obtain valuable intellectual property (IP) and public health data related to vaccines, treatments, and testing from networks and personnel affiliated with COVID-19-related research. The potential theft of this information jeopardizes the delivery of secure, effective, and efficient treatment options.

Analysis:

The FBI and CISA urge all organizations conducting research in these areas to maintain dedicated cybersecurity and insider threat practices to prevent surreptitious review or theft of COVID-19-related material. FBI is responsible for protecting the U.S. against foreign intelligence, espionage, and cyber operations, among other responsibilities. CISA is responsible for protecting the Nation’s critical infrastructure from physical and cyber threats. CISA is providing services and information to support the cybersecurity of federal and state/local/tribal/territorial entities, and private sector entities that play a critical role in COVID-19 research and response.

Recommended Actions:

Assume that press attention affiliating your organization with COVID-19 related research will lead to increased interest
and cyber activity.

  • Patch all systems for critical vulnerabilities, prioritizing timely patching for known vulnerabilities of internet-connected servers and software processing internet data.
  • Actively scan web applications for unauthorized access, modification, or anomalous activities.
  • Improve credential requirements and require
    multi-factor authentication.
  • Identify and suspend access of users exhibiting
    unusual activity.

Additionally, H-ISAC will be hosting a Targeted Threat Brief webinar addressing concerns related to Pharma and Vaccine R&D on May 14, 2020 2:30pm EDT.   DHS Cybersecurity and Infrastructure Security Agency (CISA) will lead a threat briefing for H-ISAC members focusing on nation state threats targeting specific areas of the healthcare sector involved with vaccine research and development. The presentation will be provided by the US intelligence community including NSA and law enforcement analysts from the FBI.  

Members can report activity to the H-ISAC Threat Operations Center (TOC) and H-ISAC will aggregate the information in an anonymous report to share to the FBI on behalf of the health sector.

Recognition & References:

  • Joint FBI-CISA PSA

Health Industry Cybersecurity Practices (HICP):
Managing Threats and Protecting Patients publication Original joint FBI CISA advisory

This site is registered on Toolset.com as a development site.