Dark web sells COVID-19 masks at 10 times actual cost amidst severe shortage | Threat Intelligence

CloudSEK’s digital risk monitoring platform XVigil has spotted a dark web site that claims to sell N95 and Aura 3M medical masks, “to protect you against the Corona virus.” The site owners allege that they are wholesalers, and official suppliers for hospitals. They also emphasize that the masks are original and brand-new, and aren’t stolen goods. It is notable that the actors are using a vanity domain name: coronaygwcbcgpd6.onion that includes the keyword “Corona.”

Dark web site selling masks at 10 times actual cost

The masks cost 10 times their actual price

On further investigation, we found that the masks are supposedly supplied by FarStar Medicals, a Germany based medical products manufacturer. However, the company doesn’t sell N95 respirators (only surgical masks), as per their official website.

The site directs buyers to place orders by sending an email to: facemasks@secmail.pro. The masks, which come in packs of 10, cost EUR 89 ($96) for Farstar N95, and EUR 79 ($85) for Aura 3M. This is in contrast to the actual price, of a box of 20 3M N95 respirators, which is ~$17. The payment is accepted at 2 Bitcoin addresses (backed by BitPay):

3FLQ4fHtXXn2cumA5NLKNUP7tMNCewB2Jv
3AkqRhBwqS4yuT5YxWPBoEEGECtfs758gr

So far, the Bitcoin addresses haven’t received any payments.

Piggybacking on people’s fears

Over the last few weeks, we have seen a variety of COVID-19 themed malware campaigns and phishing attacks making the rounds. Most of those cases have involved phishing emails, with attachments that purport to contain important information about the virus. However, this scam directly exploits the high demand for medical quality respirators among the general public. Despite reassurance from the World Health Organization (WHO), that masks are only necessary for the sick, and those taking care of the sick, people continue to line up at pharmacies, and hoard masks. This, combined with the severe shortage of respirators for medical professionals, requires manufacturers to ramp up production by 40%. Amidst the growing crisis, sites such as these aim to piggyback on people’s fears and anxieties, to make a quick buck.