The attack, which researchers at Check Point dubbed "Panda-19," faked two documents from the Mongolian minister of foreign affairs. The documents were disguised as updates on the prevalence of the coronavirus cases in Mongolia, but opening them would infect the target’s computer with a tool called RoyalRoad, which would take over the devices without users' knowledge.

The hackers, who have not been identified, have been in operation since 2016 — and the outbreak of the virus has not slowed them down.

“It seems like the situation in China hasn't been affecting this group,” Lotem Finkelstein, Check Point's head of threat intelligence, told BuzzFeed News.

“It is still unclear why they were targeting these specific organizations,” Finkelstein said. “But we know that they were trying to steal documents and to remote control these systems.”

Once the attachment in the email was opened and downloaded, malware would control the infected computer, allowing the attackers to take screenshots and steal information. According to Finkelstein, gaining remote access is a “very advanced capability.”

As a result of the Panda-19 attack, Finkelstein said they were able to fingerprint the group, meaning they can now track it further and help thwart future attacks. The Chinese hackers, previously known for their operations in the Eastern Hemisphere, frequently go after high-profile targets like Russian telecom companies and targets in Ukraine and Belarus.

The coronavirus hacking attacks are going to get worse before they get better, Finkelstein said. “We have seen them active for four years with no intention to stop,” he said. “So we believe that they will use the coronavirus situation [because] it is very effective.”

Check Point has also been tracking malicious domain registrations using COVID-19 keywords. Another firm, Reason Cybersecurity, has tracked fake coronavirus tracking websites set up by hackers attempting to infect users with malware. The data is genuine, Hacker News reported — but if users were to download the app, their passwords would be stolen.

Other researchers have also pointed to a high amount of phishing emails using the coronavirus as lures. These attackers have impersonated the CDC, the World Health Organization, and executives or members of HR departments.

“Coronavirus has been exhausting for us,” Sherrod DeGrippo, senior director of the threat research and detection team at Proofpoint, previously told BuzzFeed News.

Due to the virus, a total of 584 million children are staying at home worldwide, and the countries of Mongolia, China, and Korea are leading in organizing TV classes for children, highlighted Deputy Minister of Education, Culture, Science, and Sports G.Ganbayar.

Co-produced by the Ministry of Education, Culture, Science, and Sports, and the Mongolian TV Channels’ Association, online and TV classes for children in kindergartens and secondary schools are successfully being broadcast across the country.

This week, TV classes for the General Entrance Exams have begun to be broadcast on the channels of the Mongolian TV Channels’ Association.

According to health officials, a total of 126 people who had direct contact with the man, have been tested negative on coronavirus. So far 500 people have been identified as having had contact with this individual.On 11 March, 26 tests sent from Dornogobi province to Ulaanbaatar were coronavirus free.

As reported, a British national who sat next to the Frenchman on the plane from Moscow has been quarantined in Uvs Province; his Covid-19 test is on way to Ulaanbaatar and information about people who having direct contact with him will be revealed tomorrow.

The French father of two, who had been in Mongolia since 2 March, where he had arrived from Moscow on an Aeroflot flight. At the airport, he was advised to quarantine himself because he had a fever; this he ignored, going to cafes and restaurants in Ulaanbaatar and finally getting the train to Dornogobi on 7 March.As soon he was confirmed having coronavirus, he was put into quarantine on 10 March at the base of the Badrakh Energy Company, located in the Ulaanbadrakh Soum, where he worked. The French man was transferred to Ulaanbaatar from Dornogobi Province early on Wednesday (11 March).

Ulan Baatar – Bangkok 29FEB20 – 28MAR20 2 weekly cancelled
Ulan Baatar – Beijing Capital 02FEB20 – 28MAR20 5 weekly cancelled
Ulan Baatar – Busan 27FEB20 – 28MAR20 2 weekly cancelled
Ulan Baatar – Hong Kong 02FEB20 – 28MAR20 2 weekly service cancelled
Ulan Baatar – Moscow Sheremetyevo – Berlin Tegel 11MAR20 – 28MAR20 2 weekly cancelled
Ulan Baatar – Seoul Incheon 25FEB20 – 28MAR20 7 weekly reservation closed
Ulan Baatar – Tokyo Narita 23FEB20 – 28MAR20 4 weekly cancelled (Original plan: Reduce from 5 to 4 weekly 23FEB20 – 28MAR20)

Other Mongolian carriers including Aero Mongolia, Eznis Airways and Hunnu Air already cancelled all international service. Reported yesterday on Airlineroute, Aero Mongolia and Hunnu Air both stated the cancellation of all domestic service from 10MAR20 to 16MAR20. As Mongolian Authority issued the new guidance, following foreigner carriers also cancels service to Mongolia until 28MAR20. Asiana Airlines and Korean Air previously scheduled to resume Ulan Baatar service from 11MAR20.

Aeroflot
Moscow Sheremetyevo – Ulan Baatar 11MAR20 – 28MAR20 4 weekly cancelled

Air Busan
Busan – Ulan Baatar 25FEB20 – 28MAR20 2 weekly cancelled (already in effect)

Asiana Airlines
Seoul Incheon – Ulan Baatar 25FEB20 – 28MAR20 3 weekly cancelled

Korean Air
Seoul Incheon – Ulan Baatar 26FEB20 – 28MAR20 6 weekly cancelled

SCAT
Nur-Sultan – Ulan Baatar 08MAR20 – 02MAY20 2 weekly cancelled

Turkish Airlines
Istanbul – Ulan Baatar 11MAR20 – 29MAR20 3 weekly cancelled

"The French man aged 57 has been transferred to the NCCD from the country's southeastern Dornogovi province. The patient is now in serious condition," Dulmaa Nyamkhuu, head of the NCCD, told a press conference.

"Our doctors are doing everything possible to cure him," he added.

On March 2, more than 100 passengers who arrived by plane in Mongolia with the patient, and other people who have contact with him have tested negative for the virus, according to the NCCD.

Train No. 5/6 Ulan-Bator – Moscow operated by Ulan Bator Railways, as well as trains No. 305/306 operated by the Federal Passenger Company and Ulan Bator Railways, are also being suspended.

An announcement will be made when passenger services are resumed.

Unused tickets for cancelled trains and trailer carriages can be returned without incurring any additional charges and fees.

Passengers must apply for a refund at the place where they purchased their tickets. If the withdrawal from travel takes place in a country where the passenger does not have citizenship, s/he must apply to the respective railway ticket office and have it stamped with special mark showing the cancellation of the train in order to receive the subsequent refund.

Passengers can find obtain detailed information on the procedure for receiving refunds for their unused tickets and train timetables from the 24-hour phone number of the Unified Information Service Centre of Russian Railways on 8 (800) 775-00-00 when calling from within Russia and on 7 (499) 605-20-00 from abroad.