Summary
Like organized crime groups, cyber underground criminals, who typically sell drugs such as heroin, cocaine, methadone, and marijuana, are now profiting from the coronavirus pandemic. In the past week, these scammers have started selling Chloroquine, N95 masks, surgical masks for exorbitant prices, reported Armor, a global cybersecurity software provider. Armor’s discovery mirrors what European law enforcement agency Europol, is reporting. On Friday, March 27, Europol issued a report warning the public that fraudsters, cybercriminals, and organized crime groups are ramping up their activities across the EU, and one of their popular schemes includes “fraudulent coronavirus tests, fake masks and sham pharmaceutical products being touted as treatments for COVID-19.”
Similarly, Armor’s security researchers saw dark market vendors selling prescriptions of Chloroquine plus Azithromycin for $500 to $1,000. A 30-day, 250 mg. prescription of Chloroquine typically retails in the U.S. between $111-$165.
Armor also found underground vendors peddling surgical masks and N95 respirators for a 400 to 500% markup. One scammer advertised 1,000, N95 respirators for $5,200, while 1,000 respirators normally costs $1,000. They are selling surgical masks, which typically cost.46 cents apiece for $4 apiece. A box of 1,000 surgical masks will cost the buyer $4,000.
Armor’s researchers also saw criminals selling coronavirus testing kits for $39-$44, even though the FDA has not approved any at-home test kits. Armor discovered this underground activity, exploiting the Coronavirus crisis, a week ago.
Discovering the Coronavirus Frenzy on the Cyber Underground
On Monday, March 23, just four days after U.S. President Donald Trump stated in a press briefing that HydroxyChloroquine, had shown “encouraging early results” in treating COVID-19, criminals began peddling Chloroquine on the underground hacker markets. HydroxyChloroquine is FDA-approved drug typically used to treat malaria, lupus and rheumatoid arthritis. It is a derivative of Chloroquine, and both drugs are FDA-approved to treat malaria. The FDA quickly came out with a statement, after Trump first touted the two drugs as a potential antidote for COVID-19, telling the public that “no” approved drugs or therapies for the prevention or treatment of COVID-19 were currently available.
Despite the FDA’s warning and the fact that three Nigerians overdosed in the past week from Chloroquine, there is a shortage of the two drugs at U.S. pharmacies, according to news reports. Criminals on the digital black markets have seized the opportunity to sell drugs they advertise as Chloroquine.
Underground Criminals Selling Scarce, High-Priced Chloroquine
Armor’s Threat Resistance Unit (TRU) research team spotted the scarce, overly priced Chloroquine pills for sale in both popular English and Russian-speaking underground markets. The TRU team found one black market vendor selling 30 Chloroquine, pills plus azithromycin (an antibiotic used to treat bacterial infections) for $1,000 USD. See Image 1.
The same vendor advertises 30, 250 mg. Chloroquine pills, without the azithromycin, for the exorbitant price of $500. This same drug dose and amount can be purchased from U.S. pharmacies for between $111 and $165, according to GoodRx (a drug price-comparison platform). See image 2.
Armor also found another dark market criminal selling a drug that is said to be used to combat the virus, Favipiravir. The Japanese flu drug developed by Fujifilm Toyama Chemical has recently been praised by the Chinese government following clinical trials. The vendor is selling 10 pills of the drug for $100. The U.S. FDA has not approved the drug, also known by the brand name Avigan, for the treatment of COVID-19.
See image 3.
Non-FDA Approved Coronavirus Test Kits for Sale
The FDA announced in an alert last week that they have ”not authorized any at-home testing for COVID-19. ” However, as of Thursday, March 26, the TRU team saw several underground criminals selling coronavirus test kits. One such vendor is selling the kits for $44 each and another vendor has them priced at $39 per kit. Both sellers are highly-rated, dark market vendors who have extensive sales histories. They have both filled over 1,000 individual orders of other items in the past. See Image 4.
Dark Web Criminals Push N95 Respirators & Surgical Masks at 500% Above Retail, Bogus COVID-19 Cures, and Special Offers on Illicit Drugs
While some underground criminals exploit the shortage of the Chloroquine drug, others seek to profit from scarce, personal protective equipment (ppe), such as N95 respirator masks and surgical masks, bogus cures for the COVID-19 virus , hazmat suits and illicit drugs.
N95 Respirators and Surgical Masks Priced Like Gold
On one digital black market, Armor found 45 listings with “Corona,” “Coronavirus” or “Covid-19” in the product description, with half of those offering industrial masks and surgical masks in bulk. Several advertisements mention the brand 3M and model N95, the most sought-after mask with a respirator. The N95 masks, also known as a N95 filtering facepiece respirator (FFR), is a type of respirator which is capable of filtering out at least 95% of very small (0.3 micron) particles. According to the CDC, they filter all types of particles, including bacteria and viruses.
Home Depot sells a 20-pack of 3M, N95 industrial masks for $23.97, or $1.20 each. The TRU team discovered one dark market vendor selling 1,000 N95 masks for $5,200, or $5.20 each. This scammer has jacked up the price of these essential and scarce masks by more than 400% . See Image 5.
Surgical masks are also alarmingly scarce during this pandemic, Dark web criminals are also taking advantage of this shortage. One such vendor advertises 1,000 surgical masks for $4,000, or $4 each. Prior to the Coronavirus crisis, surgical masks were readily available from legitimate vendors, for around .46 cents apiece. But now, when one goes online to purchase surgical masks, especially from sellers which have numerous positive ratings, the suppliers cannot deliver them before the third week of April at the earliest, and many of them can’t deliver before May or June.
Dark market criminals are savvy, they know that surgical masks are in short supply, and that buyers need them now. However, the scammers do appear to give buyers a break if they buy in extra large volumes, e.g. quantity of 2,000, as opposed to 1,000, as shown in the advertisements. See image 5.
One sees many images in the news of healthcare workers outfitted in hazmat suits, which offer medical personnel the best protection from contracting the virus. The TRU team also discovered on the dark market an advertisement for a “Corona Virus Asbestos Protection Kit,” which apparently is seeking to take advantage of a person’s desire to purchase for themselves the maximum protection against the Coronavirus. The kit includes: a pair of coveralls, over-boots, nitrite gloves, face masks and goggles for $65 each. See Image 6.
Underground Markets Tout Unknown Drugs and Even Marijuana to Cure and/or Lessen the Effects of COVID-19
One cyber underground criminal offers an apparent cure for the Coronavirus. The offer is five doses of a Coronavirus medicine for $250 but provides no information about the type of drug used. The product description claims that some of their team members tested positive for Coronavirus and “We gave our unique product to our members and they tested negative in few treatments.” See Image 7.
In the dark market, Chloroquine is not the only drug being offered as a treatment for Coronavirus. For example, one cannabis vendor on the underground extolls the benefits of their THC capsules stating that they are “bursting with activated marijuana” and will help support your immune system against the Coronavirus and “lessen the severity of the virus.” See image 8.
But for Some, It’s a Party
Not every item being sold on the dark market focuses on exploiting the fears of the Coronavirus. One marijuana vendor advertises their “Tangie OG Coronavirus Blowout. See Image 9.
Reaction from Armor TRU Team
Armor’s discovery of the onslaught of Coronavirus-related medical items being sold on the cyber underground, mirrors what European law enforcement agency Europol is reporting, according to Chris Hinkley, Head of Armor’s TRU research team. On Friday, March 27, Europol issued a report warning the public that fraudsters, cybercriminals and organized crime groups are ramping up their activities across the EU and one of their popular schemes includes “fraudulent coronavirus tests, fake masks and sham pharmaceutical products being touted as treatments for COVID-19.”
“At a time when people around the world are desperately looking for protective equipment, drugs and testing to protect against and treat the Coronavirus, it does not surprise me that this illicit activity is on the rise,” said Hinkley. “Criminals will always find ways to capitalize on shortages and prey on people’s fears. This is why it is so important that individuals and organizations, seeking protection or treatment for the Coronavirus, confirm that they are purchasing government- approved medicines from government- regulated pharmacies and government- approved test kits and PPE (from confirmed, legitimate suppliers). If buyers do not exercise extreme caution then their actions could be fatal.”