Why would someone want to hack Germany's PPE supply chain? We're glad you masked

IBM says phishing operation could be effort to get upper hand in negotiations

Hackers are targeting German companies tasked with replenishing the nation's supply of personal protective equipment.

The team at IBM's X-Force says it has uncovered a highly targeted campaign against an unnamed German multinational outfit. That company, it is said, is part of a task force organized by the German government to procure PPE for the nation's health professionals.

With protective gear in short supply due to the ongoing COVID-19 pandemic, governments around the world have found themselves competing with one another to get their hands on masks and face shields that are essential to keeping medical workers safe when treating infected patients.

Germany, like many other countries, has enlisted the help of some of its largest companies to aid with these procurement efforts.

The X-Force team believes that the corporation is being targeted specifically because of its status within the task force (attacks began right as the company was named as a member), and the phishing campaign is part of a larger effort by an unknown hacking crew to disrupt the PPE supply chain in Germany.

"It’s important to recognize that certain elements coming together in this campaign are not coincidence; they are precision," X-Force IRIS research and operations lead Nick Rossman told The Register.

"The exact timing of the operation (coinciding with the task force’s announcement to the exact day), the specific companies being targeted, down to the specific departments within those companies being targeted, make this a highly targeted and calculated operation."

So far, X-Force reports, the operation is in its early phases, still trying to trick individuals at the company into following the phishing messages and hand over their login credentials. It is not yet known whether the attackers plan to eavesdrop on communications, move laterally through the companies' networks, or both.

What is strongly suspected, however, is that the attackers, for one reason or another, want to get an inside view of Germany's efforts to procure PPE. It is not known for sure that the hackers are government backed, though that might not matter in this era where many governments enlist private hacking crews to help with their efforts.

"This information could provide nation state actors with an advantage to support their PPE acquisition goals," Rossman explains.

Rossman says that a rival government could stand to gain significantly from thwarting Germany's PPE task force, as removing one more competitor could improve a country's position when negotiating with suppliers.

There is one more possibility, says Rossman, and it is particularly intriguing. It's possible that the hackers are in search of inside information on something far bigger than PPE: a coronavirus vaccine.

"The fact that they were targeting high-ranking executives in procurement, management and operations in companies that, together, form an essential supply chain to respond to the coronavirus crisis, leads us to believe they were seeking to exploit the new government-led procurement and supply chain initiative," he explains.

"By gaining a foothold into these organizations, they could likely gain access to sensitive data relating to companies and/or nations’ COVID-19 resources, response strategies and even possibly vaccine progress." ®