* [Blog](https://www.paloaltonetworks.com/blog) * [Palo Alto Networks](https://www.paloaltonetworks.com/blog/corporate/) * [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant) * 网络犯罪分子正在利用新冠病毒疫情发动攻击... # 网络犯罪分子正在利用新冠病毒疫情发动攻击 [](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2020%2F04%2Fhow-cybercriminals-prey-on-the-covid-19%2F%3Flang%3Dzh-hans) [](https://twitter.com/share?text=%E7%BD%91%E7%BB%9C%E7%8A%AF%E7%BD%AA%E5%88%86%E5%AD%90%E6%AD%A3%E5%9C%A8%E5%88%A9%E7%94%A8%E6%96%B0%E5%86%A0%E7%97%85%E6%AF%92%E7%96%AB%E6%83%85%E5%8F%91%E5%8A%A8%E6%94%BB%E5%87%BB&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2020%2F04%2Fhow-cybercriminals-prey-on-the-covid-19%2F%3Flang%3Dzh-hans) [](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.paloaltonetworks.com%2Fblog%2F2020%2F04%2Fhow-cybercriminals-prey-on-the-covid-19%2F%3Flang%3Dzh-hans&title=%E7%BD%91%E7%BB%9C%E7%8A%AF%E7%BD%AA%E5%88%86%E5%AD%90%E6%AD%A3%E5%9C%A8%E5%88%A9%E7%94%A8%E6%96%B0%E5%86%A0%E7%97%85%E6%AF%92%E7%96%AB%E6%83%85%E5%8F%91%E5%8A%A8%E6%94%BB%E5%87%BB&summary=&source=) [](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www.paloaltonetworks.com/blog/2020/04/how-cybercriminals-prey-on-the-covid-19/?lang=zh-hans&ts=markdown) [](mailto:?subject=网络犯罪分子正在利用新冠病毒疫情发动攻击) Link copied By [Unit 42](https://www.paloaltonetworks.com/blog/author/unit-42/?lang=zh-hans&ts=markdown "Posts by Unit 42") Apr 22, 2020 1 minutes [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) This post is also available in: [繁體中文 (繁体中文)](https://www.paloaltonetworks.com/blog/2020/04/how-cybercriminals-prey-on-the-covid-19/?lang=zh-hant "切换到 繁体中文(繁體中文)") ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/04/covid19.png) 随着新冠病毒的全球蔓延，疫情相关话题持续受到人们的高度关注。Palo Alto Networks（派拓网络）威胁情报团队Unit 42的研究人员发现，自2月初以来，与新冠病毒相关的谷歌搜索量和网址浏览量大幅增加。网络犯罪分子也正是利用这些热门话题为诱饵来从中牟利。他们毫无道德底线，尤其是在当前疫情危难时刻，这将给数十亿人的生活雪上加霜。 正是由于不法分子经常利用这些话题来进行恶意活动，Unit 42的研究人员密切监测了派拓网络客户对热门话题及与这些话题相关的新注册域名的关注度，以保护用户安全。 通过使用谷歌趋势工具和我们的流量日志发现，用户对新冠病毒相关话题的关注度爆增，且在2020年1月底、2月底和3月中旬达到高峰。 同时，随着用户关注度的上升，从2月到3月，与新冠病毒相关的域名注册量日均增长656%。在此期间，恶意注册域名增长569%，包括恶意软件和网络钓鱼；"高风险"域名注册增长788%，包括欺诈、非法加密货币挖掘，以及与恶意网址有所关联或涉嫌使用防弹主机托管的域名。 截至3月底，我们已发现116,357个与新冠病毒相关的新注册域名，其中包括2,022个恶意域名和40,261个"高风险"域名。 我们根据域名的Whois信息、DNS记录和屏幕截图（由我们的自动抓取工具收集）对这些域名进行聚类分析，以检测注册活动。我们发现，许多域名被恶意注册并转售牟利，且其中很大一部分被用于众所周知的恶意活动，并用于欺诈店铺销售短缺商品。 其他恶意滥用新冠病毒热点的传统方式还包括：域名托管恶意软件、钓鱼网站、欺诈网站、恶意广告、加密货币挖矿，以及用于提升不法网站搜索排名的黑帽搜索引擎优化（SEO）。我们检测到，许多使用新注册域名的网店不仅试图欺骗用户，其中还出现了一个尤为卑鄙的域名集群，它利用用户对新冠病毒的恐惧来进一步恐吓他们购买其产品。此外，我们还发现了一组以新冠病毒为主题的域名，它们现在使用高风险JavaScript提供托管网页服务，而这些JavaScript可能随时会将用户重定向到恶意内容。 **结论** 不幸的是，总是会有网络犯罪分子在人们的恐惧加剧时，在地区、国家和全球事件中试图伤害人们。当灾难性事件发生时，我们一次次地观察到这种行为，网络犯罪分子开始围困受害者。遗憾的是，我们认为这种剥削性行为不会很快消失。 人们应该高度怀疑任何带有COVID-19主题的电子邮件或新注册的网站，无论他们声称拥有信息、测试工具还是治疗方法。应该特别注意检查域名的合法性和安全性，例如确保域名是合法域名（google \[.\] com与g00gle \[.\] com），并且在浏览器的地址栏左侧有一个"锁"的图标，确保有效的HTTPS连接。 对于任何以COVID-19为主题的电子邮件，都应采取类似的措施---查看发件人的电子邮件地址通常会发现该内容可能不合法，因为收件人可能不知道其内容，拼写错误或长度可疑且带有随机出现的字符。 为了保护用户免受网络罪犯分子的侵害，Palo Alto Network（派拓网络）关于{#m\_8915059765830287579\_OLE\_LINK1}{#m\_8915059765830287579\_OLE\_LINK2}[URL过滤](https://urldefense.proofpoint.com/v2/url?u=https-3A__www.paloaltonetworks.cn_products_threat-2Ddetection-2Dand-2Dprevention_web-2Dsecurity&d=DwMFoQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=rlV3QLKXfVd47fRPwA7WrCCSjqFsgIzvhSPB3-jJ4YQ&m=dRJst38WL4mNNDZFWk7AEDI3t1-crzcQfrzvjwdFQ3E&s=zV2_U2Otd0EB3ZExjD5YUpG74ulKdau9u4E3rZN5W4I&e=)的最佳建议是禁止访问"新注册域名"类别。然而，如果您不能阻止对"新注册域名"类别的访问，则我们的建议是对这些网址强制实施SSL解密以提高其可视性，阻止用户下载诸如PowerShell和可执行文件之类的危险文件类型，应用更严格的威胁防护策略，并在访问新注册域名时增加日志记录。我们还建议使用[DNS层保护](https://urldefense.proofpoint.com/v2/url?u=https-3A__www.paloaltonetworks.cn_products_threat-2Ddetection-2Dand-2Dprevention_dns-2Dsecurity&d=DwMFoQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=rlV3QLKXfVd47fRPwA7WrCCSjqFsgIzvhSPB3-jJ4YQ&m=dRJst38WL4mNNDZFWk7AEDI3t1-crzcQfrzvjwdFQ3E&s=GvD2Gsui1tc-Yct8OUF3OY8ZNKKhp-ixIvDW7RpbTek&e=)，因为我们知道超过80％的恶意软件都使用DNS建立C2。 关于全文版中特别提到的威胁和入侵指标（IOC），在Palo Alto Networks（派拓网络）技术栈内已采取了以下步骤来确保达到最佳的检测和预防机制： * 已对域名、IP地址和网址进行了适当分类。 * 已更新和/或验证了所有样本的Wildfire判定。 * 已创建、更新和/或验证了入侵防御系统签名。 * 已部署、更新和/或验证了Cortex XDR检测。 * 已创建、更新和/或验证了Autofocus标签。 由于冠状病毒爆发的突然性，许多员工正在自我隔离并在家办公。尽管企业一直通过VPN连接为员工提供安全访问，但是需要安全访问的员工数量却是前所未有的，并且需要额外的资源和容量。 Palo Alto Networks（派拓网络）的云端安全访问服务边缘（SASE）平台[Prisma Access](https://urldefense.proofpoint.com/v2/url?u=https-3A__www.paloaltonetworks.cn_prisma_access&d=DwMFoQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=rlV3QLKXfVd47fRPwA7WrCCSjqFsgIzvhSPB3-jJ4YQ&m=dRJst38WL4mNNDZFWk7AEDI3t1-crzcQfrzvjwdFQ3E&s=pGVH9RPw7uPzAWb7x8E3Ud6ZEqzn8gvuOzdDrqZ-wnc&e=)，可为远程办公室和移动用户提供统一的策略实施和安全性，并将随着业务需求的发展而调整规模。 要了解有关Palo Alto Networks（派拓网络）如何帮助您的远程员工的更多信息，请在[此处](https://urldefense.proofpoint.com/v2/url?u=https-3A__www.paloaltonetworks.cn_our-2Dresponse-2Dto-2Dcovid-2D19&d=DwMFoQ&c=V9IgWpI5PvzTw83UyHGVSoW3Uc1MFWe5J8PTfkrzVSo&r=rlV3QLKXfVd47fRPwA7WrCCSjqFsgIzvhSPB3-jJ4YQ&m=dRJst38WL4mNNDZFWk7AEDI3t1-crzcQfrzvjwdFQ3E&s=Yx6vzHECCgXrzYRDNwQ5mh02Qk1BxFaaRZsE_bk1rjc&e=)查看我们的资源，并查看[Nir Zuk的网络广播](https://register.paloaltonetworks.com/securemobileworkforce)，了解如何实现业务连续性。 有关此次研究的更多信息，请访问[此处](https://unit42.paloaltonetworks.com/how-cybercriminals-prey-on-the-covid-19-pandemic/)阅读全文。 ![](https://www.paloaltonetworks.com/blog/wp-content/uploads/2020/04/QR-Code-WechatIMG1252.jpeg) 敬请关注Palo Alto Networks（派拓网络）官方微信账号 *** ** * ** *** ## Related Blogs ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### AI代理已經來臨，威脅也隨之而來](https://www.paloaltonetworks.com/blog/2025/05/ai-agents-threats/?lang=zh-hant) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Strata Copilot - 加速迈向自主网络安全的未来](https://www.paloaltonetworks.com/blog/network-security/strata-copilot/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 防火墙已死？至少本世纪不会！](https://www.paloaltonetworks.com/blog/2023/08/ngfw-is-not-dead-yet/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 面对性命攸关的时刻，如何实现可靠的医疗物联网安全](https://www.paloaltonetworks.com/blog/2022/12/medical-iot-security-to-depend-on/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### 利用业界首创的 AIOps for NGFW 革新防火墙运行](https://www.paloaltonetworks.com/blog/2022/03/industry-first-aiops-for-ngfw/?lang=zh-hans) ### [未分类](https://www.paloaltonetworks.com/blog/category/%e6%9c%aa%e5%88%86%e7%b1%bb/?lang=zh-hant&ts=markdown) [#### Prisma Access 是保护远程用户安全的领先云服务](https://www.paloaltonetworks.com/blog/2021/08/prisma-access-leading-cloud-service-secure-remote-users/?lang=zh-hans) ### Subscribe to the Blog! Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more. ![spinner](https://www.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up Please enter a valid email. By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder. This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply. {#footer} {#footer} ## Products and Services * [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown) * [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown) * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown) * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown) * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown) * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown) * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown) * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown) * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown) * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown) * [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown) * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown) * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown) * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown) * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown) * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown) * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown) * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown) * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown) * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown) * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown) * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown) * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown) * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown) * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown) * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown) * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown) * [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown) * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown) * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown) * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown) * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown) * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown) * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown) * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown) * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown) * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown) * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown) * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown) * [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown) * [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown) * [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown) * [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown) * [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown) ## Company * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown) * [Careers](https://jobs.paloaltonetworks.com/en/) * [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown) * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown) * [Customers](https://www.paloaltonetworks.com/customers?ts=markdown) * [Investor Relations](https://investors.paloaltonetworks.com/) * [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown) * [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown) ## Popular Links * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown) * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown) * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown) * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown) * [Event Center](https://events.paloaltonetworks.com/) * [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center) * [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown) * [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown) * [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown) * [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown) * [Tech Docs](https://docs.paloaltonetworks.com/) * [Unit 42](https://unit42.paloaltonetworks.com/) * [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd) ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg) * [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) * [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown) * [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) * [Documents](https://www.paloaltonetworks.com/legal?ts=markdown) Copyright © 2026 Palo Alto Networks. All Rights Reserved * [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks) * [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown) * [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/) * [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks) * [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks) * EN Select your language