FYI - Work Document Malicious E-mail [Archive]

mARC

09-07-2015, 10:35 AM

FYI - Received from Our IT Service Provider

Subject: Hacker Alert: Word attachments

Dear X

Would you please distribute this alert to all staff members.

Another problem email is in circulation currently which is evading blocking measures. Please be vigilant for emails with Word document attachments. The emails can appear to come from someone you know and the document contains malicious macros which will execute on your machine. Either delete them without opening or if you do need to inspect it then this can be done using a new tool called BankVault (see below). One example of this is below but the headlines and text are easily substituted with alternatives:

Heading: Fwd: Transfer Number: 026QOQ29. Amount: 3892.18 AUD
From: eaubenite@bigpond.com.au
To: yourname@yourname.com.au (accounts@central-data.net)
Attachment: 026QOQ29.doc (https://email.gopc.net/service/home/%7E/?auth=co&loc=en_AU&id=759179&part=2)
Body: Warning notice for accounts@yourname.com.au
Pay Anyone transfer: 026QOQ29
Amount: 3892.18 AUD
Status: Cancelled by customer
Please review the word document provided below to view more details about this issue.

The language and finessing in these emails has become far more sophisticated and customers are being duped.

If you have any concerns or need to inspect a questionable email then you can do so with complete immunity using a low cost cyber security technology called BankVault. BankVault stops bank account hacking, keeping online transaction invisible and out-of-reach from hackers. It is immune to the viruses, malware and cyber hacking techniques used by most hackers and can be considered the last line of defense.

BankVault is new technology innovation from GoPC. This alert is a FREE service from GoPC but is being transitioned to a BankVault initiative. Would you please ensure your filters do not block emails from BankVaultOnline.com.

mys1

09-07-2015, 11:44 AM

We get heaps of these a day.

Why people open them I'll never know...

brynj

09-07-2015, 11:53 AM

Our 'Safety and Risk' coordinator opened an attachment on one of these recently and had to get her computer reimaged. One more for the workplace risk register.

_S9_

09-07-2015, 12:23 PM

- Receive dodgy looking email
- open attachment
- allow macros to run
- macro opens facebook
- candy crush request.

Lonewolf

09-07-2015, 01:04 PM

have had clients open attachments and cause days of downtime.
Then not long after they've done it again.

*Sigh*

Phyber

09-07-2015, 01:29 PM

Have had client departments forward them internally to multiple members to see if anyone was able to open the attachment, heh

Emails be like

------------
Dear somebody you never heard of

How is so and so? Please find attached my resume.

Your's truly,
Some Bozo
------------

It's unfortunate that they do advertise positions and expect resumes. Oh well, life goes on.

killabeez

09-07-2015, 01:45 PM

Recently had a staff member open an AFP issued speeding fine (lol) and install cryptolocker on our main production server. That was a fun few days.

satch

09-07-2015, 03:35 PM

fuck me, the amount of those we had, despite sending notifications saying not to open them. I think people just ignore emails from IT.

[Jacek]

09-07-2015, 04:21 PM

Recently had a staff member open an AFP issued speeding fine (lol) and install cryptolocker on our main production server. That was a fun few days.

We had one of these Cryptolockers last week - wow, pain in the arse. Luckily we were back in action after about half a day of downtime :|

mARC

10-07-2015, 08:25 AM

I don't understand why people open them either, but where there's a market I guess..

Have had client departments forward them internally to multiple members to see if anyone was able to open the attachment, heh

Feel your pain but genuinely kek'd.

The_Senator

10-07-2015, 08:38 AM

Same here.. AFP E-mail... E-mailed all staff to alert them to ignore it as it was a virus , and to simply delete.. Receptionist decides that she knows better and opens it.. Encrypted her machine - and she rang me to whinge that nothing would open.. And she had work to do!

Fortunately she was locked down tight enough that it did not get any further than her machine.. Still took it out of action for 1/2 a day while it was re-imaged.. When prompted why she opened it she simply said "No one said that I should not".. When asked if she would have opened it on her home PC she replied "probably not, i don't open strange e-mails"...

eSet must have released an signature update for it by the afternoon, as we then starting catching them all before it hit the user..

E-mails from IT must go straight to the "do not read" folders.. And they wonder why we get annoyed...

Bit like one of the users brining in his home laptop and wanting the WiFi password 'cause he needed to update his O/S and his data allowance for the month had run out at home..

_S9_

10-07-2015, 10:27 AM

Bit like one of the users brining in his home laptop and wanting the WiFi password 'cause he needed to update his O/S and his data allowance for the month had run out at home..

Don't have a guest wifi network (firewalled from corporate network) for your staff?

Also if your corporate wifi is protected by just a WPA2 password then you're also part of the problem :P

The_Senator

10-07-2015, 11:11 AM

WEP encyption is where it's at..