Coronavirus: Iran-linked hackers targeted drug maker Gilead

The US company is behind remdesivir, the only treatment to have so far proven effective against the virus

The experimental drug remdesivir has been authorised by the US and Japan for emergency use against Covid-19. AFP

Hackers linked to Iran have targeted staff at US drug maker Gilead Sciences Inc in recent weeks, according to publicly-available web archives reviewed by Reuters and three cybersecurity researchers, as the company races to deploy a treatment for the Covid-19 virus.

In one case, a fake email login page designed to steal passwords was sent in April to a top Gilead executive involved in legal and corporate affairs, according to an archived version on a website used to scan for malicious web addresses. Reuters was not able to determine whether the attack was successful.

Ohad Zaidenberg, lead intelligence researcher at Israeli cybersecurity firm ClearSky, who closely tracks Iranian hacking activity and has investigated the attacks, said the attempt was part of an effort by an Iranian group to compromise email accounts of staff at the company using messages that impersonated journalists.

Two other cybersecurity researchers, who were not authorised to speak publicly about their analysis, confirmed that the web domains and hosting servers used in the hacking attempts were linked to Iran.

Iran's mission to the United Nations denied any involvement in the attacks. "The Iranian government does not engage in cyber warfare," said spokesman Alireza Miryousefi. "Cyber activities Iran engages in are purely defensive and to protect against further attacks on Iranian infrastructure."

Medical personnel carry out the transfer of residents from a nursing home who tested positive for the COVID-19 in Buenos Aires, Argentina. EPA

A nurse administers care to a patient in the acute care COVID unit at Harborview Medical Center on May 7, 2020 in Seattle, Washington. AFP

A member of a disinfection team walks along swabbing booths at a testing center for COVID-19 disease at the SM MOA Arena in Manila, Philippines. EPA

BBC Television Centre in London is lit up in tribute to the National Health Service workers and carers fighting the coronavirus pandemic. PA via AP

Members of a team dedicated to burying Muslim victims of the new coronavirus disinfect their tools at the Langata Muslim cemetery, in Nairobi, Kenya. AP Photo

A soldier of French antiterrorist plan "Vigipirate Mission" patrols front of Sacre Coeur Basilica in the Montmartre district in Paris, France. AP Photo

Commuters adhere to physical distancing measures while queueing at the Germiston Taxi Rank, near Johannesburg, South Africa. AFP

Visitors wear protective masks as they tour the Forbidden City, which recently re-opened to limited visitors, in Beijing, China. Getty Images

Women wearing face mask protection to prevent the spread of the coronavirus talk seated on a bench in a public park, in Pamplona, northern Spain. AP Photo

French singer Veronica Antonelli sings from her apartment window in Paris. AP Photo

Rosa Leyva, right, and her nephew Viridiana wait for customers at her stall where she sells plastic flower arrangements and religious images, outside the San Rafael cemetery, in Ciudad Juarez, Mexico. Reuters

Australian residents returning from India are ushered towards waiting buses for the beginning of their 14-day mandatory quarantine, after arriving at Sydney International Airport in Sydney, Australia. EPA

People, who were detained for violating El Salvador's nationwide lockdown measures, protest after authorities did not release them despite having served their mandatory quarantine at a detention center, in San Salvador, El Salvador. Reuters

Protesters calling for Gov. Gavin Newsom to ease stay-at-home order caused by the coronavirus, gather at the Capitol in Sacramento, California, USA. AP Photo

A spokesman for Gilead declined to comment, citing a company policy not to discuss cybersecurity matters. Reuters could not determine if any of the attempts were successful, on whose behalf the Iranian hackers were working or their motivation.

Still, the hacking attempts show how cyber spies around the world are focusing their intelligence-gathering efforts on information about Covid-19, the disease caused by the novel coronavirus.

Reuters has reported in recent weeks that hackers with links to Iran and other groups have also attempted to break into the World Health Organisation, and that attackers linked to Vietnam targeted the Chinese government over its handling of the coronavirus outbreak.

Remdesivir was originally developed to treat Ebola, but has proven effective against the novel coronavirus. Reuters

Britain and the United States warned this week that state-backed hackers are attacking pharmaceutical companies and research institutions working on treatments for the new disease.

The joint statement did not name any of the attacked organisations, but two people familiar with the matter said one of the targets was Gilead, whose antiviral drug remdesivir is the only treatment so far proven to help patients infected with Covid-19.

The hacking infrastructure used in the attempt to compromise the Gilead executive's email account has previously been used in cyberattacks by a group of suspected Iranian hackers known as "Charming Kitten," said Priscilla Moriuchi, director of strategic threat development at US cybersecurity firm Recorded Future, who reviewed the web archives identified by Reuters.

"Access to even just the email of staff at a cutting-edge Western pharmaceutical company could give ... the Iranian government an advantage in developing treatments and countering the disease," said Ms Moriuchi, a former analyst with the US National Security Agency.

Iran has suffered acutely from the Covid-19, recording the highest death toll in the Middle East. The disease has so far killed more than 260,000 people worldwide, triggering a global race between governments, private pharmaceutical companies and researchers to develop a cure.

Gilead is at the forefront of that race and has been lauded by US President Donald Trump, who met the California company's CEO Daniel O'Day at the White House in March and May to discuss its work on Covid-19.

The US Food and Drug Administration last week gave emergency use authorisation to Gilead's remdesivir for patients with severe Covid-19, clearing the way for broader use in more hospitals around the United States.

An official at one European biotech company said the industry was on "red alert" and taking extra precautions to guard against attempts to steal Covid-19 research, such as conducting all work related to vaccine trials on "air-gapped" computers that are disconnected from the internet.