May Email Scam Roundup – NAB, Origin, ASIC & more

We will take a look at some of the most recent email scams targeting Australian businesses from May 2017. Share this list with your colleagues to spread awareness of recent scams which may come across your email inbox. Follow us on Linkedin & Facebook for regular updates.

The month of May saw the global “WannaCry” ransomware scam become first page news and infect many notable organisations in particular the National Health Service (NHS) in the U.K.

Despite the media attention many other scam emails with similar malicious intent went across the nation unreported by the mainstream media.

To verify, report or learn more about a scam contact the ATO Scam Report or ScamWatch.

ASIC

The Australian Securities & Investments Commission is a regularly impersonated target for scam emails, we’ve written in the past here and here about a few different types of malicious emails which have been sent from criminals posing as ASIC.

The emails which are being sent from the domain australiangovernments.com, are advising recipients to review their company renewal letter using the link provided. The link itself is pointed to malicious file named”renewal.zip” which could do numerous things including encrypting data and make a log of all keys pressed to gather important information.

Similar to previous scam emails, the communication is well worded, branded with ASIC logos and signed off by a “Senior Executive Leader” who does not actually exist. ASIC urges recipients not to let curiosity get the best of them and delete these emails immediately.

Instructions from the ASIC website – Scams Targeting ASIC Customers

Scammers pretending to be from ASIC have been contacting Registry customers asking them to pay fees and give personal information to renew their business or company name.

These emails often have a link that provides an invoice with fake payment details or infects your computer with malware if you click the link.

Cyber Insurance Australia can help reduce the costs of cyber crime for your business. 

Get a quote today!

Origin Energy

A very convincing fake email has been sent in the tens of thousands this month containing near perfect Origin Energy branding. Most Australians now receive their energy bills via email instead of post which is great for the environment but has potential vulnerabilities. Scammers have replicated a common Origin email complete with logos and links to the real Origin Energy Privacy Policy to help lend further credibility to the email. Victims who clicked to download and view their bill are directed to a compromised Microsoft SharePoint account which is designed to install malicious software onto their system. The amount due will differ from email to email in an attempt to evade anti-virus software.

According to Mailguard, a fake domain called Originenergysolar.net was recently registered in China and the emails were sent from France.

NAB

National Australia Bank has always had a pretty consistent run with cyber criminals using their likeness for many different phishing campaigns. This scam email informs the recipient that their account has been disabled,  simply click the included link to reactivate your account, sounds easy enough. The link points to a duplicate of the real NAB website which prompts users for their NAB ID and password. A standard phishing email approach but one which still gets results.

In this instance the emails are coming from discharge.authority@nab.com.au. Criminals trick unsuspecting bank customers into putting their actual bank information into the fake website which is then used for unauthorised transactions.

WannaCry

By this point many Australians are aware of the “wannaCry” ransomware attack which has dominated the media more than it has dominated Australian businesses. The Prime Minister’s cyber security advisor Alastair MacGibbon told AFR, “there had been one likely case of the WannaCry ransomware attack on a small business but the impact of the attack had been limited.”
“We have not seen the wholesale impact we are seeing in the UK and Europe,” he said. “It has not affected our hospitals or other critical infrastructure.”
Experts are attributing some of Australia’s luck avoiding the scam down to a time zone difference, many Australian businesses had stopped trading for the weekend when the emails were arriving. which in turn did not give enough time for staff to view the scam email.

An attack targeting devices running Microsoft Windows which have not been updated with a security patch were the ones at risk. The purpose of the scam is to gain access to a network, encrypt the data and demand a bitcoin ransom within a short time frame or risk total data loss as can be seen in the above screenshot.

According to reports, more than 230,000 computers in over 150 countries had fallen victim to the scam yet official Australian reports indicate less than 15 Australian organisations were exposed. This attack affected many major services across the globe such as the National Health Service(NHS) in the UK and FedEx.

These scams happen every single day despite the lack of media coverage or direction from the government to raise awareness for business owners. An even more devastating variant of ransomware is already being seen by security researchers which won’t be widely reported on until it is on your doorstep.

Cyber Insurance Australia can help reduce the costs of cyber crime for your business.

Get a quote today!

Feel free to comment with any malicious emails we missed. Each month we will be updating and reporting new malicious emails making the rounds for Australian businesses.

Subscribe and follow Cyber Insurance Australia on Linkedin & Facebook for regular updates and information. Thanks to MailGuard , subscribe to the security blog for regular updates here.

To ensure email security for your business, contact DDM Security Systems to learn more about email encryption & protection.

Share this list with your colleagues to help spread the word before one of these nefarious emails ends up at your business.

Read more

April Email Scam Roundup – ASIC, MyGov, eWAY & MYOB

Scam Emails Targeting Australian Businesses

We will take a look at some of the most recent email scams targeting Australian businesses from April 2017. Share this list with your colleagues to spread awareness of recent scams which may come across your email inbox.

April was another strong month for email scams with new variations showing up and interesting methods of attack.

To verify, report or learn more about a scam contact the ATO Scam Report or ScamWatch.

My Gov

With more than 11 million accounts or roughly 50% of the population, the Australian government online portal is a prime target for scammers trying to imitate government departments holding sensitive information. A legitimate looking email sent from no-reply@mygov.net has caused many raised eyebrows after recipients were advised to verify their identity using the link contained in the email.

Victims who clicked the link were directed to the above fake website intended to dupe recipients into sharing their password and credit card information. The only indicator of the fraudulent nature of the site is the unusual URL which is not an Australian Government domain. According to Mailguard, upon further inspection the source code for the authentic government website has been directly copied for the above clone.
After inputting their username and password the victim is prompted to confirm credit card information as can be seen below.

After providing credit card information the victim is redirected to the real My Gov website in order to confuse and attempt to validate the email request. According to MailGuard, the email originated from servers hosted in the Czech Republic, which are likely to have been compromised. The sending address used is noreply@mygov.net, which has no relationship with the legitimate portal

Cyber Insurance Can Help Reduce Costs Following Email Scams.

Get a quote today!

ASIC

The Australian Securities and Investments Commission is always popping up in these lists of scams due to the nature of their work. In this email scam business owners are sent a well branded, legitimate reading email regarding the renewal of their company. With complete ASIC logo, wording and legitimate links to the ASIC privacy policy the unsuspecting business owner can easily mistake this email for official communication. Especially if received around the correct date before their official ASIC renewal.

Victims are prompted to follow a link to find their renewal letter, instead the link contains java script code designed to install malicious software on their computer systems. The software is then likely to download additional ransomware or a trojan causing business interruptions and unforeseen costs for victims. The email was sent from a newly created austgov.com domain, instead of the legitimate ASIC site, asic.gov.au. The fake domain which was registered in China has experts speculating that due to Chinese registration laws, it is likely that a stolen ID was used to create the domain which raises further questions about the people behind these scams.

MYOB

Thousands of fake MYOB emails have begun making their way to inboxes across Australia. The well branded email appears to be a legitimate invoice from a company using the MYOB software package. As is common with these email scams, additional links to the real website are included in the fine print of the email to add validity. The link to the invoice however will direct victims to a compromised SharePoint website containing a malicious file.

Similar to the above ASIC scam and many in the past, the emails were sent from a fake, newly-registered domain myob-australia.com. Many variations of the email wording and company info have been observed from many recipients, which indicates the culprits are attempting to obscure their red flags from antivirus software.

Once the victim’s curiosity gets the best of them and they follow the link, the malicious software will install itself to automatically run when the machine is switched on in an attempt to capture private information from internet browsers.

eWAY

Online payment company eWAY has had their corporate identity imitated in a bulk run of scam emails which targeted Australians with macros capable of downloading malicious software.
The fake emails were sent from a recently registered domain, estoreway.info, instead of the legitimate Australia-based site, eway.com.au. The emails not only came from an incorrect domain which is quickly verified using google,  unusual grammar is also a clear sign throughout the text.

A screenshot of the email scam courtesy of Mailguard seen below advises recipients their recent purchase has been approved and will be shipped to the address in the attached invoice.

The attached invoice contains a Word document with a malware downloader within. The attachment is capable of downloading and executing malicious software to record and gather sensitive information. In an additional attempt for the scammers to establish legitimacy the attachment requires a password to unlock and view the ‘invoice’. Once victims click on the attachment they will receive instructions to “Enable Editing”  which essentially opens the door for criminals to begin automatically installing malicious files.

Cyber Insurance Can Help Reduce Costs Following Email Scams.

Get a quote today!

That is our April list of malicious emails to keep a look out for, feel free to comment with any malicious emails we missed. Each month we will be updating and reporting new malicious emails making the rounds for Australian businesses.

Subscribe and follow Cyber Insurance Australia on Linkedin & Facebook for regular updates and information. Thanks to MailGuard , subscribe to the security blog for regular updates here.

To ensure email security for your business, contact DDM Security Systems to learn more about email encryption & protection.

Share this list with your colleagues to help spread the word before one of these nefarious emails ends up at your business.

The ASIC website offers the following advice for avoiding email scams:

• Keep your antivirus software up to date
• Be wary of emails that don’t address you by name or misspell your details and have unknown attachments
• Don’t click any links on a suspicious email.

Above all we recommend educating employees to recognise suspicious emails and unusual behavior without curiosity getting the best of them.

Read more

March Malicious Emails Targeting Australian Business

Malicious March Madness

It’s time for the malicious emails that came up in March 2017, we will take a look at some of the most recent email scams targeting Australian businesses. Share this list with your colleagues to spread awareness of recent scams which may come across your email inbox.

To verify, report or learn more about a scam contact the ATO Scam Report or ScamWatch.

National Australia Bank

NAB customers were made aware of 2 different scams during March to look out for, one using SMS phishing and the other using email phishing. NAB updates their internal security page with fraud warnings for their customers as they discover them, we recommend monitoring these warnings if you bank with NAB.

The SMS phishing incident involved an NAB branded SMS stating that the customers card is now locked and to simply follow the included link to update security details. Of course, the link included is a malicious clone of the NAB website designed to confirm banking credentials and “unlock” the card as seen below.

NAB’s email phishing warning is very similar to the above text message trick, instead of a locked card the email indicates unusual activity on the customer’s account which needs to be confirmed urgently. The included link leads to a fake clone of the NAB website asking for banking and credit card credentials. As is commonly seen, the sending address was spoofed to be shown as alert@nab.com.au but the real sending address was upuxbsafde@rivals.com as can be seen below.

NAB has urged customers to contact their local branch or call 13 22 65 if they received either of the above phishing attempts.

 Help protect your business from malicious emails with cyber insurance.

Get a quote today!

ASIC Renewal Notices

ASIC is a common target due to the information and regularity with which they interact with business owners. This month MailGuard reported an ASIC email which was distributed tens of thousands of times from a new email domain registered in China. The malicious emails which claim to be from the Australian Securities and Investment Commission contain a link to a malware downloader which begins an intrusion usually ending in ransomware and extortion.

We report on ASIC scams each month with no end in site, previous malicious emails can be found here and here. Similar to previous malicious emails, the government branding and ASIC logo head the page to start legitimate.  Recipients are then instructed to follow the link and renew their company information or email a legitimate ASIC email address to cancel their registration.

Instead of the legitimate ASIC domain of @asic.gov.au the email came from ASIC-Transaction.No-reply@@asic-gov-au.co and the employee sending the request “Max Morgan” does not exist either.

“These emails often have a link that provides an invoice with fake payment details or infects your computer with malware if you click the link,” the ASIC website says.

Australian Taxation Office

Another government agency which seems to have a constant stream of malicious impersonators is the Australian Taxation Office. This month has 2 malicious emails from ATO. The first claims that the recipient’s 2016 tax return  has revealed “several inconsistencies” which can be fixed by following the link to download a report and visit their nearest ATO in person to clarify the discrepancies.

The malicious link downloads a piece of malware and begins the infection.

The second fake ATO email making the rounds this month is very similar except in this instance the recipient can receive a tax refund they weren’t aware of, free money. Simply complete the online form located in the included link and the ATO will return whichever amount was listed in the email.

Unlike the first email, this is a little more complex. The enclosed link directs the user to an ATO branded online form designed to gather sensitive information for identity theft and credit card fraud.

The tax office will never send a request for additional funds or discrepancies. If you receive similar emails and would like to verify legitimacy, contact the ATO.

 Help protect your business from malicious emails with cyber insurance.

Get a quote today!

That is our March list of malicious emails to keep a look out for, feel free to comment with any malicious emails we missed. Each month we will be updating and reporting new malicious emails making the rounds for Australian businesses.

Subscribe and follow Cyber Insurance Australia on Linkedin & Facebook for regular updates and information. Thanks to MailGuard & Hoaxslayer, subscribe to the security blog for regular updates here.

To ensure email security for your business, contact DDM Security Systems to learn more about email encryption & protection.

Share this list with your colleagues to help spread the word before one of these nefarious emails ends up at your business.

Read more

February Malicious Emails To Watch Out For

Malicious Emails Being Sent In Alarming Volumes

Here is our February 2017 wrap-up of malicious emails making the rounds for Australian businesses.

Cyber risk awareness is slowly growing but still has a long way to go before email phishing scams start to lose the incredible financial incentive. Share this list with your colleagues to spread awareness of recent scams which may come across your email inbox.

To verify, report or learn more about a scam contact the ATO Scam Report or ScamWatch.

Citibank

Australian Citibank customers have been the victims of the most elaborate scam email of the past few months involving replica websites and fake SMS security codes. The inclusion of SMS is extremely unusual and indicates the elaborate lengths criminals are taking. The scam itself notifies Citibank customers their account has been ‘temporarily limited’ as a result of invalid online log-in attempts. Customers are directed to follow a link to sign in and restore their online access.

Customers are then redirected to a very realistic replica of the authentic Citibank website which prompts the user input their User ID and password.

Unfortunate victims who put their details into the replica website are then prompted to verify extra personal information such as their mobile phone number and date of birth.

The next officially branded Citibank page will advise that a “one-time PIN Authentication” has been sent via SMS and advises to wait at least 5 minutes for the code to arrive. This ingenious method replicates the real two-factor authentication security procedure used by Citibank legitimately.  In this time, the scammers have a short window to log in to the real Citibank website disguised as the customer. At this stage the scammer has obtained the User ID and password, allowing them to make any transaction they want which triggers the correct security code to be sent to their victim’s phone. The victim then inputs their security code which goes straight to the scammer and in turn allows them to finalise and transaction they like.

These emails can be exceedingly hard to spot as scammers are putting unseen levels of effort into duping the average recipient. This sophisticated scam tricks visitors into thinking they are dealing with the legitimate Citibank site but in reality the  domain begins with rctproduction.cz which is a Children’s party business in Czech Republic.

Citibank has requested all suspicious emails be sent to spoof@citicorp.com.

Strange Parking Fines

A recent wave of peculiar emails has been reported which has raised a few eyebrows regarding the unpaid bill the recipient apparently failed to settle earlier. Fake parking infringement notices have been circulating for years but this surprisingly low dollar amount is causing curiosity to get the best of some recipients. Sums as low as $1.04 and upward of $100 are showing up with a 50% discount if paid within 14 days. Simply view the attached “ticket” for details and quickly settle the previously unknown fine.

At the time of detection by MailGuard, zero of 64 well-known antivirus vendors had flagged the link as suspicious. as can be seen at virustotal.com

The unbranded email link triggers a malicious software downloader hidden in a seemingly innocuous .zip file. Once enabled, the people behind the email are capable of downloading further malware like ransomware or key-logging software. This scam is very similar to the previous driver infringement notice email we discussed last month.

Australian Taxation Office

Perhaps the most commonly used government department for malicious email scams would have to be the Australian Taxation Office or the ATO. The email in this attempt was sent from ‘basnotification@ato.gov.au’ which appears legitimate but was traced to a compromised SendGrid account which provides bulk email delivery services.  Recipients are greeted with legitimate looking email addresses, formatting, wording and the official government coat of arms.

If clicked, the suspicious link triggers an automatic download of malicious files hosted on another compromised SharePoint site. Once on your machine, the malicious .zip file executes a JavaScript file which is used to download further malicious software such as ransomware, key-logging software and spyware. The extra layers of legitimacy don’t just fool recipients but are also used to trick antivirus software. Again, at the time of discovery none of the 64 well-known antivirus providers were detecting the link as a potential danger, only MailGuard had reported the suspicious email.

The ATO featured last month with another email, this is yet another perfect example of employee education being key to identifying these emails.

Help protect your business from malicious emails with cyber insurance.

Get a quote today!

Fake Apple Account Email

An Apple email phishing scam has been discovered which is attempting to trick users into giving away their log-in information with a simple tactic. The malicious email has gone undetected by switching a lot of common letters with Greek alphabet characters ρ, υ and ω in place of p, u and w as can be seen in the screenshot below. Altering characters in this manner can help obfuscate common phrases which would normally be picked up from content filters  in your antivirus.

The differing letters can clearly be seen in the above screenshot after someone points out the difference but would pass by many recipients unless paying attention. The email states that Apple is updating their user accounts but was not able to update your account and requests the user to do so by clicking the embedded link.

Users are presented with a mirror replica of the apple sign-in page and prompted to enter their account information. The fake sign-in page will also resize and adapt to different device screen sizes such as mobile phones and tablets. This tactic has been around for many years but clearly the method has not died out yet as it still nets results and warrants effort for cyber criminals.

Help protect your business from malicious emails with cyber insurance.

Get a quote today!

That is our February list of malicious emails to keep a look out for. Each month we will be updating and reporting new malicious emails making the rounds for Australia Businesses.

Thanks to MailGuard, subscribe to the security blog for regular updates here.

Share this list with your colleagues to help spread the word before one of these nefarious emails ends up at your business.

Read more