IBM, together with several Partners of the Charter of Trust launched an initiative earlier this year to build the Charter’s threat information sharing capability related to digital infrastructures and the IoT supply chain.

By Nick Rossmann, Global Lead for Threat Intelligence, IBM Security X-Force

My team at IBM, a Partner of the Charter of Trust, discovered a malicious cyber operation in which a currently unknown adversary masqueraded as one of the world’s largest cold-chain providers in a global email phishing campaign seemingly aimed at spying on entities essential to the global distribution of Covid-19 vaccines.

From the onset of the pandemic, Covid-19 phishing emails have been one of the most prolific scams observed by the security community this year. Since late-January, attackers have duped recipients into opening emails with subject lines related to the novel coronavirus. Victims the world over, living in fear of the pandemic and its health and economic impact, received these emails and were enticed to click on their infected links and attachments. Doing so has led to compromises of individual devices and corporate networks, and ultimately to the theft of personal and company data. The fact that more employees are working from home during the pandemic, lacking in many instances sufficient cybersecurity protections, has exacerbated this threat and increased the need for organizations to take measures to address these security risks and be on alert.

The hackers claimed to represent Qingdao Haier Biomedical Co., a China-based company and one of the world’s largest cold-chain suppliers, making equipment to store and deliver materials at cold temperatures. In at least one copy of the spam email, the fake Haier representative sought to purchase about 500 vaccine refrigerators to bolster their temperature-controlled logistical services. The user, who purports to serve as Haier’s project manager in Africa, promised a $220,000 upfront payment, according to an email provided by the IBM security researchers. Attached to the email is a draft contract entitled, “RFQ – UNICEF CCEOP and Vaccine Project.” But the HTML attachment was actually a malicious file that, if opened, would prompt the recipient to share their secret login credentials with the attacker.

IBM’s security team has been researching Covid-19-related cyber-attacks and sharing with the Charter of Trust threat information sharing network since the early days of the pandemic. Based on the sophistication of this attack, which targeted a variety of industries related to vaccine storage and delivery before hackers cleaned up their digital footprints, researchers believe the campaign was launched by a nation-state, but declined to speculate on which one.

It’s unclear if any victims fell for the scam. But if they did, the harvested credentials could help an attacker “gain insight into internal communications, as well as the process, methods and plans to distribute a Covid-19 vaccine.

As pharmaceutical companies and governments the world over prepare for the logistical puzzle of disseminating hundreds of millions of vaccines to help blunt the coronavirus, cyber-criminals continue to leverage the urgency and despair of the global pandemic for intelligence and monetary gain. In this case, the phishing scheme spanned six countries and targeted European organizations that bolster immunization in poor countries.

In late November, the Atlanta-based cold chain company Americold Realty Trust said it was the target of a cyber-attack. The company believes the attack has been contained, but hadn’t “completed its investigation,” Americold said in a Nov. 30 regulatory filing. The company didn’t expect the hack to impact operations. Americold didn’t respond to requests for comment on the scope of the attack and the role email phishing may have played.

“As we shift toward distributing a vaccine for Covid-19, the logistics of this operation will become extremely critical,” said John Hultquist, a senior director at the cybersecurity firm FireEye Inc. “Seemingly mundane security issues could have major repercussions to such a complex and important effort.”

As Pfizer Inc. and Moderna Inc. work with U.S. and global regulators to approve their Covid-19 vaccines for emergency use, global distribution has already started. Pfizer and United Airlines transported the first mass air shipment of a vaccine from Brussels to Chicago in late November.

Pfizer’s vaccine must be stored at ultra-cold temperatures to avoid contamination. But maintaining temperature controls once a vaccine leaves the airplane remains a challenge. In parts of West Africa, for instance, temperatures in mid-December range from 70 to 90 degrees Fahrenheit. Even states in the U.S. lack necessary capacity to store large volumes of the vaccine without spoiling. This makes cold chain companies like China’s Haier essential to global distribution.

It also makes them prime targets for spoofing campaigns, said Claire Zaboeva, Senior Cyber Threat Analyst at IBM’s Security X-Force. Targets of the phishing operation have included the European Commission’s Directorate-General for Taxation and Customs Union, according to IBM. The agency is responsible for streamlining customs and duties as goods travel across the European Union. Attackers may see the agency as a single point of compromise to disrupt distribution across the region. Petrochemical companies were also targeted, since they produce dry ice to keep vials cool.

This was a well-prepared, precise, sophisticated campaign. We can’t ignore the fact that there are actors who will benefit from disrupting distribution of the vaccine. If an actor could disrupt consumer trust in the vaccine, that could play a pivotal role in changing perceptions of world power.

Raising cyber security resilience through collaboration between partners, is becoming a key objective for most companies. That is why IBM, together with several Partners of the Charter of Trust launched an initiative earlier this year to build the Charter’s threat information sharing capability related to digital infrastructures and the IoT supply chain. One of the first deliverables was to share threat information relating to Covid-19 and this case shows how relevant this topic is. The Charter of Trust has in parallel developed baseline security requirements for the supply chain, and this case also shows that such baseline requirements need to be complimented by security awareness since the methods used by adversaries evade normal security measures.

The more information on threats organizations, institutions and governments have access to, the better they can prepare to defend against them – making collaborative initiatives such as the Charter of Trust’s threat sharing platform, essential to thwarting off cyberattacks and safeguarding our digital environments.

You may also like

Contribution to the EU Commission Public Consultation on the revision of the Cybersecurity Act
icon External Engagement

Contribution to the EU Commission Public Consultation on the revision of the Cybersecurity Act

The Charter of Trust welcomes the opportunity to participate in the European Commission’s public consultation on the revision of the Cybersecurity Act. As a coalition united by the goal of strengthening digital trust, we are pleased to share our consolidated response and recommendations.

We support Policy Option 2, which focuses on targeted regulatory measures that address key challenges without creating unnecessary complexity. In this context, we emphasize the need to enhance the role and resources of ENISA, to ensure effective implementation of both current legislation and the European Cybersecurity Certification Framework (ECCF).

Our recommendations aim to improve transparency, collaboration, and efficiency across the EU’s cybersecurity landscape. These include:

- Introducing clear timelines for the development of certification schemes.

- Enhancing stakeholder engagement throughout the process.

- Establishing more structured communication channels between ENISA, the Stakeholder Cybersecurity Certification Group (SCCG), and sectoral ISACs (Information Sharing and Analysis Centers).

We call for a stronger ECCF, one that is transparent, inclusive, and aligned with international standards to foster global interoperability and ease compliance for organizations across borders. Equally critical is the harmonization of certification practices across EU member states and the mutual recognition of certifications to minimize regulatory fragmentation.

The Charter of Trust advocates for technically robust, standards-based certification schemes, with well-defined roles and responsibilities. We also stress the need for clarity on the interplay between voluntary and mandatory certifications, particularly in relation to the upcoming Cyber Resilience Act (CRA).

To streamline compliance and reduce administrative burden, we propose a unified, risk-based incident reporting regime that consolidates requirements under regulations such as NIS2, CRA, GDPR, and DORA. This would not only simplify reporting for organizations but also enhance the EU’s overall cyber resilience. In addition, we recommend incorporating liability protections and grace periods for incident disclosure.

Finally, we urge the Commission to strengthen supply chain security by adopting a risk-based classification approach and establishing baseline cybersecurity requirements for ICT suppliers.

The Charter of Trust remains fully committed to supporting the European Commission in shaping a secure, resilient, and trusted digital future for Europe. We look forward to continued collaboration in building a cybersecurity framework that meets the needs of all stakeholders, today and in the years to come.
June 19, 2025
Advancing Regulatory Alignment at RSA Conference 2025
icon External Engagement

Advancing Regulatory Alignment at RSA Conference 2025

In the face of rising global cyber threats, over 50 CISOs have called for greater international alignment of cybersecurity regulations to strengthen defenses and reduce fragmentation. This message was echoed at RSAC 2025, where experts from the OECD, European Commission, academia, and industry emphasized the need for principle-based collaboration. The Charter of Trust, a long-time advocate for regulatory harmonization, continues to support coordinated, effective approaches that prioritize clarity over complexity.
May 01, 2025
Richards Skalt takes over the Advocacy Workstream
icon External Engagement

Richards Skalt takes over the Advocacy Workstream

We are delighted to welcome Richard Skalt, Advocacy Manager at TÜV SÜD, as the new Leader of the Advocacy Workstream at the Charter of Trust. Richard steps into the role following María del Pino González-Junco, who recently assumed the position of Chair of the Global External Engagement Working Group.

With a strong background in advocacy and a forward-looking vision, Richard brings renewed energy to our mission of shaping a secure digital future. As he puts it:

“My motivation is to preserve and build upon the strong foundation of advocacy activities we’ve developed over the past years. At the same time, I’m committed to ensuring we’re in a position to shape the policies that will define how our business model and operations evolve in the future – including the cybersecurity of products and systems, the use, deployment, and distribution of robust AI solutions, as well as cloud security and secure datacenters.”

In a world defined by accelerating digital transformation and increasingly complex regulatory challenges, principled leadership and effective collaboration are more vital than ever. Under Richard’s leadership, the Advocacy Workstream will continue to engage policymakers, raise public awareness, and strengthen education around key issues such as cybersecurity, AI governance, and secure digital infrastructures.
April 29, 2025