Spear phishing outbreak?

[Synkrox]

Just wondering if anyone has seen a higher than average amount of seemingly targeted "spear phishing" spam aimed at staff accounts lately?

They come through personally addressed - often with infected zip files and phishing links in the email (which get removed by filter) but otherwise quite well worded - Hence them getting through at all.

I'm wondering if it may be limited to us or schools in general?

 

Couple of examples:

Dear Valued Customer,

 

This is a short email to let you know that your Natwest Credit Card Online Services security details was recently changed on Wednesday, January 29, 2014 at 04:00: PM. Please confirm that this request was made by you.

 

Yes, I made this request. (link removed)

 

 

No, I did not make this request. (link removed)

 

Best wishes

 

David Wayne

Head of Credit Card

 

Notice to Appear,

 

Hereby you are notified that you have been scheduled to appear for your hearing that will take place in the court of

London in January 31, 2014 at 10:00 am.

 

Please bring all documents and witnesses relating to this case with you to Court on your hearing date.

 

The copy of the court notice is attached to this letter.

Please, read it thoroughly.

 

Note: If you do not attend the hearing the judge may hear the case in your absence.

 

Yours truly,

L.McNamara

Clerk to the Court.

[featured_spectre]

Nah I get those in my personal emails all the time.

[JonDaviesBourne]

I have noticed quite a number of those recently, do we know if these are coming from a common source? Obviously attachments and links get stripped out, but it still doesn't look good if we have the actual emails getting through...

[rich_tech]

There has been a rise of these in the mails of late, also you get ones mimicking amazon deliveries as well, we had to warn staff about them on a "be mindful about them" level.

[Synkrox]

From the ones I have seen they don't appear to be from a common source, but do seem to be from otherwise legitimate email addresses and were copied into some other schools email addresses, both specific users and enquiry@ addresses

[JonDaviesBourne]

Yeah, we've had ones to admin@ and specific addresses. They seem to be getting creative though...

[CHR1S]

Had loads of these to personal and school addresses, 10+ a day most days!

[stdg11]

We've noticed a huge increase in spam, generally with infected zip files too. Worryingly the spammers seem to know who the Admins are and have worked out who our bursar is.

Regrettably Mouchel manage our services (hopefully not for much longer) their McAfee spam filter is not holding up.

Edited February 7, 2014 by stdg11

[dhicks]

Just wondering if anyone has seen a higher than average amount of seemingly targeted "spear phishing" spam aimed at staff accounts lately?

 

Yes, something of a flurry of them over the past week or two. As a guess, I'd say it looks like fallout from hacked Yahoo! Mail accounts and similar - several members of staff seem to have had assorted external mail accounts broken into, and their contacts list is now receiving spam.

[hawc]

All I get is 'Do you want a longer kn@b' emails.

[Synkrox]

Flaring up again over the last few days - anyone else?

[fairm010]

All I get is 'Do you want a longer kn@b' emails. - Giggidy

 

Flaring up again over the last few days - anyone else? - HAHA GIGGIDY

[featured_spectre]

http://www.transadvocate.com/wp-content/uploads/2013/02/I-See-What-You-Did-There..png

[sonofsanta]

I had a count up of our Quarantined Spam folder before half term, when we migrated to the land of milk & honey (Office 365 and its filters).

 

Over 50,000 emails in a year. And that's the ones that we caught lots of DHL deliveries, credit card, online banking, flight tickets... as well as various pills and tablets to, er, make you more impressive, shall we say.

 

EDIT: possibly of relevance, in a self-advertising sort of way ICT Tip #18 - Avoiding Scam Emails - Blogs - EduGeek.net

Edited February 25, 2014 by sonofsanta