Re: Active Phishing Attack Against EDUs

["Manjak, Martin" <mmanjak () ALBANY EDU>]

There are lots a CIF notations for that address. Perhaps the most relevant is this one:

2018-01-18T13:46:04Z

2018-01-18T13:46:04Z

31.220.2.200

95

spam

Direct UBE sources, spam operations & spam services

None

http://www.spamhaus.org/query/bl?ip=31.220.2.200



Marty Manjak
CISO
University at Albany

From: The EDUCAUSE Security Constituent Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> On Behalf Of Dicovitsky, Paul
Sent: Friday, June 22, 2018 9:05 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Active Phishing Attack Against EDUs


Joe,



Thank you, kindly, for sharing this information. Middlebury College was targeted by a similar attack on Tuesday the 
19th, one day before your note.



We received approximately 500 phishing messages, with the subject line of  "Board Policy Professional Standards For All 
Middlebury College Employees", all including a PDF file that consisted of a static image and a hyperlink to the 
phishing credential harvesting page.



Middlebury's email security systems successfully stripped the malicious attachment from the incoming messages, blunting 
any potential impact.



The phishing kit was hosted at https://lamntdrelaetda.date/Middlebury/  [IP address 31.220.2.200]. Directory browsing 
was not enabled on the server.



The attacker sent the phishing messages using a compromised albright.edu account. The attacker submitted the phishing 
messages to the albirght.edu account using a VPN service, ExpressVPN, with an X-Originating-IP address of 45.56.149.68.



Our team supplied the attacker with bogus set of credentials - a honeypot account - and proceeded to monitor for login 
attempts. Of note, that attacker tested the honey account with in 5 minutes of the bogus credentials being supplied, 
using the same ExpressVPN address (45.56.149.68).



Relevant SMTP headers from the original message follow:

From: "XXXXXXX"
<XXXXX () albright edu<mailto:XXXXX () albright edu>>

Subject: Board Policy Professional Standards For All Middlebury College

Employees

Date: Tue, 19 Jun 2018 14:43:46 +0000


Accept-Language: en-US


Content-Language: en-US

X-MS-Has-Attach: yes

X-MS-TNEF-Correlator:

Authentication-Results-Original: spf=none (sender IP is )

smtp.mailfrom=XXXXXXX () albright edu<mailto:smtp.mailfrom=XXXXXXX () albright edu>;

x-originating-ip: [45.56.149.68]

received-spf: None (protection.outlook.com:
albright.edu does not designate


permitted sender hosts)





Kindly,
 Paul Dicovitsky
 Systems & Security Manager | ITS | Middlebury College
 802-443-5085

*Signing up for Multi-Factor Authentication is the single most effective step you can take to protect your Middlebury 
account. Learn more at Middlebury's MFA page<http://go.middlebury.edu/mfa> and s<http://go.middlebury.edu/getmfa>ign up 
for MFA today<http://go.middlebury.edu/getmfa>.

________________________________
From: The EDUCAUSE Security Constituent Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV 
EDUCAUSE EDU>> on behalf of Sargent, Joe E <Joe.Sargent () WS EDU<mailto:Joe.Sargent () WS EDU>>
Sent: Wednesday, June 20, 2018 4:35 PM
To: SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>
Subject: [SECURITY] Active Phishing Attack Against EDUs


Earlier today most of our employees received a phishing email that appeared to be from our president.  After some 
research we found that were able view the site structure where the link directed users.  We were the only school in the 
list at that time.  As the day has progressed more and more schools have been built into the structure.  Some schools 
were there and then were modified to other schools. So, this is very active.  They even have a certificate on the site 
to make it more legitimate.  The PDF in the email did not have any active content but did contain the link to the 
website.  Here are the schools we have seen so far and have not been able to contact (this appears to still be active 
with schools being added throughout the day)...



Central Methodist University

Columbia College in Missouri

Champlain College

Walla Walla Community College

Waldorf University

Middlebury College

Texas A&M University San Antonio



Many of these schools may have already had emails go to their users... Other maybe not.  Below is the information we 
have gathered that may help you protect your users...



Our initial email came from... (might be different for you)  From: Robin Esparza [mailto:resparza () lbschools net]



The link in the document directs you to one of these for your school... (however, we have seen the links change and it 
is possible that this is not your school now - see notes below)

Your school will be represented by an abbreviation in the root of the web site



Mokaortmdesm.club/<yourschool>/index.php

Mokaortmdesm.club/<yourschoolhttps>/index.php



IP address of web site: 89.36.213.44



The method used to ID schools was to go to the link and input fake information and click submit.  This then sent us to 
a link at the target school that would make a user believe the original email was real because it is policy etc.  We 
have seen this link change for some schools and later point to another school.  So, if the link it not there now then 
look at the folders at the root of the web site to be sure that your school has not been moved to another folder.



If you go to the top level of the website you can actually see the directory structure.  To actually find out where 
each is pointing to you have to click the folder/file and then click download on the web site.  Enter fake information 
and then it will take you to a linked page at the targeted school.  It took us a while to figure this out.  Again, this 
is active and they appear to have made changes to files and links.  We have seen their processes change as they create 
more sites.



I hope this helps you.  Apologies if it turns out to be nothing but at least you can block your users from getting to 
the web site.



Thank you,

Joe

_____________________________________________________________
Joe Sargent  Assistant Vice President for Information and Educational Technologies (IET) and CIO
Walters State  Jack E. Campbell College Center Suite 314  500 South Davy Crockett Parkway

Morristown, TN 37813  Voice (423) 585-6836  Fax: (423) 585-2630  E-mail: joe.sargent () ws edu<mailto:joey.sargent () 
ws edu>


This transmission, regardless of modality, may contain confidential information and may be subject to protection under 
the law. If you are not the intended recipient, or an authorized agent for the intended recipient, you are hereby 
notified that use, such as but not limited to disclosure, copying, or distribution, is prohibited. Please destroy any 
and all copies immediately and notify the sender of this erroneous receipt.