Covid-19 spawns illegal trade of PPE and antiviral drugs: Sophos

• Most of the drugs on offer appeared to be legitimate products manufactured by genuine pharmaceutical companies, but some were clearly scams
• The PPE kits were likely stolen from warehouses or diverted during shipping

The covid-19 pandemic has spawned a global illegal trade of essential goods like PPE kits and antiviral drugs on the dark web, according to a new research by Sophos. Researchers noted trade of goods worth up to $1,000,000 per week on the dark web.

Cybercriminals have been quick to adapt to the global coronavirus pandemic with scammers and malicious actors flooding the internet with covid-related keywords. Empire Market is one of the most popular places to buy illegal goods on the dark web, transacting a little over $1,000,000 a week.

It is also one of the few prominent dark web markets that hasn’t banned the sale of pandemic-related goods. The market has over 52,000 listings across 11 categories but drugs and chemicals dwarfs all others, noted John Shier, senior security advisor, Sophos.

On 30 May 2019, there were 24,569 listings in Empire Market’s Drugs & Chemicals category. A year later there are over 34,000 showing a year-over-year increase of almost 42%. The market currently has many listings that feature either coronavirus or covid-19 as a reason for discounts.

“The vendor who posted the most ads for hydroxychloroquine on Empire, a total of 33, claims to have an unlimited supply and will sell you a whopping 9,000 pills for $1,194. There was one listing for favipiravir, by a vendor who also offered hand sanitizer and an ‘asbestos protection kit’ re-purposed to protect against COVID-19,” noted Shier.

Most of the drugs on offer appeared to be legitimate products manufactured by genuine pharmaceutical companies, but some were clearly scams. What’s unclear is whether these discounts were being offered because the vendors were afraid that business might dry up, or because they anticipated a dramatic surge in orders as a result of movement restrictions.

“There is a smattering of listings for PPE (personal protective equipment) on Empire Market, most of which are for face masks. The masks varied in protectiveness from simple surgical masks to N99 masks. Prices ranged from tens of dollars for one mask to thousands for boxes of masks,” said Shier.

The researcher also found several examples of covid-19 rapid test kits being offered on Empire and was able to identify that six of the nine different kits found were being legitimately manufactured. Initially, the site was selling testing kits, and the same products were also available on a sister site with a similar name. All four domains associated with this seller were registered in March and three of them are a variation on the phrase “corona safe”.

Shier further noted that like many of the prescription drugs on offer, the kits were likely stolen from warehouses or diverted during shipping. Any mask that’s for sale on Empire Market isn’t available for resource-strapped healthcare workers, and is driving up the price of what’s left of the limited supply PPE.

Among cases of frauds, Sophos also found listings for fake digital/online course to scam people who may have lost jobs during the pandemic.