The Google Threat Analysis Group (TAG) - a unit within Google's security division that tracks cyber crime groups nationwide - released its security report for the first quarter of this year.

And Google analysts identified in the first quarter report two trends they see as bullish in the first three months of 2020.

The first trend is the emergence of piracy rental companies currently operating in India, a country where these services have not appeared in the past.

The second trend is the increasing number of political influence operations by governments around the world on social media platforms, and this also marks the first time that Google publishes official documents for coordinated political influence operations that have offended social media platforms, especially after the Cambridge Analytica scandal and elections. American 2016.

Indian hacking service companies

According to Google, the attacks that exploited the issue of the spread of the Coruna virus were one of the most common trends the company had seen among cybercrime operators nationwide in the first quarter of 2020.

While the company detected activity from Chinese and Iranian piracy groups, there was also a new group of threat actors exploiting the virus epidemic to launch cyber attacks.

"We've seen a new activity from hackers for money," many of which are in India, which are creating Gmail postal accounts that impersonate the World Health Organization, "said Shane Huntley, head of brands at Google.

"The accounts have largely targeted business leaders in financial services, consulting and healthcare companies in many countries, including the United States, Slovenia, Canada, India, Bahrain, Cyprus and the United Kingdom," he added.

Huntley noted that the e-mails sent in these campaigns urged individuals to subscribe to receive direct notifications from the World Health Organization, to stay informed of the announcements related to the Coronavirus.

Emails are linked to the attacker's hosting websites that are similar to the official WHO website, but they contain fake login pages that collect credentials for potential victims from Google, and sometimes more information, such as a phone number.

While there are many penetration companies that lease their services all over the world, most of them are located in the European Union, Israel and some Arab countries, and this is the first time that Indian companies have been spotted performing this type of activity.

According to the Tag group, Indian hackers represent the lowest percentage of more than 270 threats from more than 50 countries tracked by the Google Tag team.

Indian experts were not previously on the list of nationalities working in the field of piracy (Reuters)

Coordinated leverage operations

Tag Team members said they are also looking at groups ’activity that has taken part in coordinated social and political influence operations, given that many of these operations are now taking place on Google’s network of websites, such as YouTube, Play Store, Ad Sense and other advertising platforms.

Tag said it had tracked seven leverage operations in the first quarter of 2020, some of which were also happening on Twitter and Facebook, following the highlights of the company’s operations in the first three months of this year:

January

Google shut down three channels on YouTube because it is part of a coordinated influence process linked to Iran, and the company said it had linked the campaign to the state-sponsored IUM news organization, which was publishing the organization's content covering Iran's raids on Iraq and politics American Oil Company, more details of this campaign are also available in a report from Graphika, a company that uses artificial intelligence to study the social landscape of the media today.

February

Google also said it had terminated one advertising account and 82 YouTube channels that are used as part of a coordinated impact process linked to Egypt, and Tag experts said the campaign shares political content in Arabic that supports Saudi Arabia, the UAE, Egypt and Bahrain and criticizes Iran and Qatar.

And Google found evidence that this campaign is linked to the New Cairo digital marketing company (New Waves), and Facebook has taken action against this campaign as well, and the details of the campaign were also mentioned in another report from Graphica.

Countries are still using technical companies to impose their political influence despite the Cambridge Analytica (Getty) scandal

March

March was the most active month in Google, with Tag launching a campaign on five different impact operations, and Google said it had banned an app developer on the Play Store and ended 68 YouTube channels as part of a coordinated impact process.

The campaign was publishing political content in Arabic in support of Turkey and criticizing the UAE and Yemen, and Google also said that Twitter took action in this campaign as well.

Google has also terminated one advertising account and 17 YouTube channels, and has banned a developer on the Play Store as part of a campaign against the coordinated influence process linked to Egypt.

Google said that the campaign publishes political content in the Arabic language that supports Saudi Arabia, the UAE, Egypt and Bahrain and criticizes Iran and Qatar.

Twitter also took measures against this campaign, and said that the information "obtained externally" indicates that the campaign operators were taking their orders from the Egyptian government.

Google has also banned a Play Store developer, and has canceled 78 YouTube channels as part of its actions against the coordinated influence process linked to Serbia.

Google said that the campaign promoted pro-Serb political content, and Twitter also terminated 8558 accounts that were part of this campaign, and the company said that most of the accounts were promoting the ruling party in Serbia and its leader.