January 2021: FB-ISAO Physical Threat Level Remains SEVERE; Cyber Threat Level Remains GUARDED

This message is TLP:WHITE. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.

The ongoing COVID-19 global pandemic is a complex and blended threat impacting members and the broader faith-based and charity community in numerous ways and that continues to impact security and response, both to manmade and natural threats. FB-ISAO’s Threat and Incident Response Group (TIG) continues to assess the ongoing threats and risks to our community and has made the following updates to our Threat Level Assessments:

The TIG has determined to maintain the Physical Threat Level at “SEVERE.” SEVERE means an event is highly likely. Given the ongoing threat of the COVID-19 pandemic and the approaching U.S. winter season and associated health concerns, we have determined to maintain the broad Physical Threat Level at SEVERE and anticipate this level being maintained until a decrease in the threat of the pandemic as vaccines are administered and a possible decrease of travel as the winter season and seasonal health threats pass. The TIG will continue to assess the Physical Threat Level regularly and provide updates accordingly. This determination will be periodically re-evaluated, especially with respect to non-COVID-19-related threats.

The TIG has determined to maintain the Cyber Threat Level at “GUARDED.” GUARDED means FB-ISAO is unaware of any specific or targeted cyber attacks, but a general risk of cyber attacks exist, particularly with respect to phishing using FB-ISAO’s likeness, the SolarWinds Orion compromise, and scams using first of the year observance “Days”. The TIG will continue to assess the Cyber Threat Level and provide updates accordingly. Likewise, the cyber threat landscape will be continuously monitored, but this Cyber Threat Level determination is valid until further notice. Please see below for on-going considerations regarding the Cyber Threat Level.

• Please refer to this post for an explainer on the FB-ISAO Threat Levels.
• Please see this 15 May 2020 post regarding the distribution of the FB-ISAO Pandemic Reopening Reentry Checklist. 
• Please refer to this CDC guidance for FBOs: Considerations for Communities of Faith, which is periodically updated (this update, 30 Dec 2020).

Concerns Regarding the Physical Threat Level

COVID-19 Pandemic. As we continue through this pandemic, with jurisdictions around the country and internationally having moved back to more stringent local restrictions based on the continued surge of COVID-19, FB-ISAO continues to strongly encourage members “hold the line”. By hold the line, we mean continue to follow FSLTT guidance and directives and reopen, reenter and resume operations in accordance with, and not ahead of, such guidance and directives. Especially during the start of flu season, and the likely confluence of COVID-19 and annual influenza threats, members are advised to respect and adhere to FSLTT guidance.

The pandemic has continued to surge and, though a decrease in new cases was observed at the end of December, hospitalizations are at record highs and  new cases and deaths remain very high, with potential increases following holiday travel. As of 30 Dec, we are approaching seven million new cases since our last assessment (from 12.5 million cases and 259,005 deaths, to almost 19.43 million cases and 337,419 deaths) and as of 28 Dec, the CDC reports that the national ensemble forecasting predicts significantly increasing numbers of anticipated deaths with “12,400 to 24,300 new deaths will likely be reported in the week ending January 23, 2021. The national ensemble predicts that a total of 383,000 to 424,000 COVID-19 deaths will be reported by this date.” Based on current behaviors and trends and the slow rollout of the vaccines, the surge in cases and deaths will continue through the winter before an anticipated tapering off as we move towards spring. The distribution of vaccines is underway in the United States and across the globe. While this is an exciting development, the distribution will take time and preventive measures are still important as we move into the new year. Additionally, the U.S. has seen considerable holiday season travel and there is a potential surge in cases from associated travel and events that could facilitate outbreaks in both new cases and resulting deaths. As recently observed, there are continued mutations of COVID-19, such as the variation from the United Kingdom, along with variations from South Africa and Nigeria. which is expected, that seem to more quickly spread the virus. The UK variant has been observed in the U.S., first in Colorado, then in California, and is likely already spreading elsewhere. As noted above, this current situation is further complicated by annual flu season, which typically peaks in February but can last as late as May, and which has the potential to complicate and further overwhelm healthcare professionals and facilities. Some have referred to this dual threat as a “twindemic” – meaning the continuation of the COVID-19 pandemic and the start of flu season. While twindemic concerns have decreased based in extensive seasonal flu vaccines and COVID-related restrictions, the potential remains throughout the flu season. Exacerbating these challenges is the increasing challenge of “pandemic fatigue,” as Americans grow tired of restrictions and seek to return to normalcy. While understandable, a decrease in vigilance and safety will only prolong recovery and a return to a more open and safe environment.  

While there is a lot of conflicting reporting and varied assessments regarding the threat, and as both personally and organizationally, many are understandably feeling pandemic fatigue, the coronavirus remains a very active health threat with continued local outbreaks or broader flare-ups, with more potential concerns particularly if established best practices such as social distancing and mask wearing are not followed. FB-ISAO assesses that we remain in a high risk period. 

Worth noting, many FBOs have begun or continued phased reopening and by applying smart practices and safety measures, they have been able to avoid outbreaks at their facilities and among their congregations. These successes are commendable but recognizing success should not lead to complacency or a false sense that the threat has passed. As we wrestle with pandemic fatigue and the continued surge in cases, we need to avoid the danger of overconfidence. Outbreaks can happen quickly and lead to closures and broad infections, as has been observed in communities and FBOs around the country. For those that have been successful, we encourage you to maintain discipline and hold on to your success.

As leaders, we encourage members to fight complacency and fatigue. FBOs should not base policies or enforcement on personal feelings, politics, or other subjective considerations. While as individuals we may agree or disagree with specific measures, FB-ISAO continues to strongly discourage defying state and local guidance and directives and encourages members to reopen, reenter and resume operations in accordance with government guidance and directives. 

Again, we encourage members to adhere to established best practices such as social distancing and mask wearing, and to make informed decisions based on observable data, not personal or political feelings.

Beyond the explicit health threat, we have other security concerns, including:

• Protests (General). Since June, we have expressed concern over the potential that protest activities will continue to pose direct and indirect threats to FBOs. Observed throughout 2020 and noted in previous threat assessments and FB-ISAO reporting, whether seen as supportive of protests – directly, logistically, or as sanctuaries or meeting places – or if seen as being opposed to protests, FBOs have been attacked from both sides. We continue to assess protests may pose direct and indirect risks to FBOs. With continued frustrations over the 2020 elections or with new frustrations that may develop with an incoming presidential administration, protests may again flare-up in the weeks ahead.
• Protests (Inauguration Day and Ongoing Election Issues). While the U.S. general election is over, the pending Inauguration of Joe Biden and Kamala Harris is still being contested by some. With a high-profile election runoff in Georgia (05 Jan) and continued tensions leading up to the 20 Jan Inauguration, there are the continued possibility of election-related protests and conflict. 
• Vaccine-Related Protests. If an FBO becomes involved in vaccine distribution / administration, there is the potential that anti-vaccination protests could develop or that disturbed/disgruntled people attacking vaccination centers. We assess this to be a low-level threat but one for FBOs to consider as they may be involved in vaccine distribution and related activities.  
• Disgruntled Individuals. Individuals who do not agree with positions taken by an FBO during periods of closure and reopening may take action against those organizations or others. We have continued to see various protests and violent actions aimed at COVID restrictions and individuals enforcing safety procedures. Last updated on 01 Sep, the CDC released Limiting Workplace Violence Associated with COVID-19 Prevention Policies in Retail and Services Businesses. While not aimed at FBOs, the guidance may be useful for safety and security personnel to consider. As FBOs reopen and welcome back individuals, some individuals have demonstrated heightened sensitivities regarding these issues and have not responded well to personnel attempting to enforce safety actions. FBOs should prepare “frontline” staff and volunteers regarding how to engage personnel, when to ask for help from senior personnel, and other considerations to prepare them to effectively communicate and assist visitors. Effective ways to safely engage individuals and de-escalation training could help prepare frontline personnel.
• Nashville Attack and Conspiracy Theories. While the motivation behind the Christmas Day 2020 Nashville attack is not clear, it is possible that conspiracy beliefs / misinformation-related anxiety (i.e., 5G concerns) could have played a part. Already, there has been misinformation alleging the explosion was an attempted government cover-up to hide election fraud, and other such theories. It is possible that, inspired by Nashville and perhaps with additional motivations such as concerns over the election, the Inauguration, and the COVID vaccines, others may be inspired to action. While FBOs may not be a primary target of such angst, they could be, and could also be indirectly targeted by way of location and neighboring facilities.  
• Hostile Events and the Targeting of FBOs, Both People and Facilities. As acts of violence, vandalism and arson are being reported regularly in the FB-ISAO Daily Journal, including hate crimes such as spray-painting hate symbols and the destruction of statues, arson and stabbings, it is important to note there are often connections between other issues and events and actions that may be taken at FBOs. Relating to protests and for other issues, and sometimes for no clear grievance, FBOs have been targeted by a variety of types of aggression and violence – at facilities, on statues, with threats, and more. This is unlikely to change in our current environment. Further, Europe has seen several low-tech terrorism attacks conducted by violent jihadists. While such attacks have not occurred recently in the U.S., terrorist propaganda continues to promote attacks and it is possible would-be jihadists could seek to conduct attacks domestically, and potentially aimed at FBOs, as has been observed overseas.

Concerns Regarding the Cyber Threat Level

FB-ISAO assess the current volume of coronavirus-related cyber attack campaigns continues to recede and the pre-pandemic frequency of non-coronavirus lures is consistent with a general “GUARDED” posture. While we assess remaining at “GUARDED” is reasonable, increased vigilance is still recommended due to the ongoing pandemic and associated concerns and distractions.Additionally, if you haven’t already, members are highly encouraged to familiarize themselves with the FB-ISAO Weekly Advisory for 23 December 2020 regarding phishing activity using the likeness of FB-ISAO that could potentially be related to #BlueLeaks. Finally, members are encouraged to review the #cybersecurity_general channel in FB-ISAO Slack for a general level of awareness to on-going cyber threats and incidents.

As we offer the constant reminder that WE ARE ALL TARGETS of opportunity, the following are general considerations for continued vigilance:

• #BlueLeaks. We continue to stress the need to exercise vigilance when receiving communications purporting to come from any impacted organization, including FB-ISAO, fusion centers, and law enforcement entities (see FB-ISAO Weekly Advisory for 23 December 2020).
• Phishing. Cyber tactics such as phishing, smishing (SMS phishing), vishing (voice phishing), whaling (targeting of high-profile targets), disinformation/misinformation, and counterfeit websites leveraging current events represent a perpetual threat. Furthermore, while the traditional holiday shopping season is behind us, threat actors will likely attempt to leverage upcoming sales related to national observance “Day’s” such as Martin Luther King, Jr. Day, Valentine’s Day, Presidents’ Day (Washington’s Birthday), etc. Members are urged to treat every sale and solicitation communication with suspicion.
• SolarWinds. While the recent compromise of the SolarWinds Orion product is presumed less likely to impact most FBO’s, a general threat still exists from similar third-party product/service compromises. Information on SolarWinds has been included in several editions of the Faith-Based Daily Journal and other TLP:WHITE summaries sent by FB-ISAO since December 13, 2020. Additionally, information is available in a CISA Insights: What Every Leader Needs to Know About the Ongoing APT Cyber Activity. Members are encouraged to exercise due diligence when implementing third-party products and services. Please contact our team for more information on vendor risk management.
• On-going ransomware attacks with subsequent leaked data. Ransomware continues impacting organizations of all types and sizes. Members are encouraged to review ransomware and data breach playbooks, policies, and procedures with staff and MSPs and discuss necessary actions should ransomware impact your organization or third party partners. For more on ransomware preparedness and response, see the Ransomware Guide from CISA and the MS-ISAC.
• Continued “Zoombombing.” Faith-based organizations continue to experience disturbing and heart-wrenching “Zoombombing” incidents. Many Zoombombing incidents occur due to public posting of meeting links and often deficient procedures when hosting such videoconferencing events. Members are encouraged to review the security settings on their video-conferencing platforms and apply best practices and procedures to reduce the risk from this prevalent disturbance. Most teleconference platform vendors have published tips for maintaining secure meetings and FB-ISAO has previously shared tips for securing online events. Please contact our team with questions.
• Mis/disinformation is still a concern. Mis/disinformation continues to spread regarding coronavirus related and other highly charged matters, including post-election activity. It is imperative to think critically and continue verifying everything. Visit CISA’s #Protect2020 resources, including the Disinformation Stops With You infographic to better understand the continued threats to the election process.
• Continue enabling/encouraging remote staff to work securely. As organizations continue prolonged or permanent work from home models, it is important to promote a secure remote work environment. To enable safe telecommuting, review CISA’s Telework Guidance and Resources page and StaySafeOnline’s COVID-19 Security Resource Library.
• Continue providing threat awareness training to staff. There are many open source examples of emails, lures, images, and indicators of compromise being shared daily in the FB-ISAO Daily Journal. Consider appropriate ways to use that information to educate and better prepare staff. FB-ISAO is happy to help develop education and cybersecurity awareness materials for dissemination.

Please contact our team with any questions, needs for information, assistance or any other concerns.

• We encourage members to review the FB-ISAO Daily Journal for general threat awareness, updates and ideas on what other organizations are doing.
• Join the #covid-19, #protest_awareness, #cybersecurity, #terrorism_us and other topical channels in FB-ISAO Slack to see more updates, reports, and conversation on threats, and to share your questions, ideas, and actions for others.

This assessment has been developed by FB-ISAO and is our general, nationwide, cyber threat assessment for the U.S. community of faith. As always, for local threat information, members are encouraged to work closely with neighborhood partners, local law enforcement, state and local fusion centers, local FBI field offices, DHS Protective Security Advisors (PSAs), Cybersecurity Advisors (CSAs), and other local experts and responders.