The university is in the middle of a serious spear-phishing attack and is the direct target of a group of criminals who have registered and set up a South African website to fool university users into providing their e-mail addresses, usernames and passwords. 

Undoubtedly the same criminal cartel is now using e-mail accounts that were compromised in the last attack. (This time a senior lecturer at Stellenbosch Campus) The registered a South African domain name and have disguised the website to look like the university’s WebMail Login page.

Spear phishing is an email-spoofing attack that targets a specific organization or individual like the university and is not typically initiated by random hackers, but by perpetrators out for financial gain. As with emails used in regular phishing expeditions, spear-phishing messages appear to come from a trusted source. This case a sun.ac.za address. The apparent source of the email is likely to be an individual within the recipient’s own company — generally, someone in a position of authority — or from someone the target knows personally, thus its potential danger.

It is important that you do NOT click on any of the included links in the mail or enter your username or password. You should never do this at any time, as Information Technology would never ask you to do so!

Just because the mail looks legitimate and the web page *looks* like it is genuine, does not make it so.

If you have received mail that looks like this please immediately report it to the Information Technology Security Team using the following method:

Send the spam/phishing mail to help@sun.ac.za

If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and password you should immediately go to http://www.sun.ac.za/useradm and change the passwords on ALL your university accounts (making sure the new password is completely different, and is a strong password that will not be easily guessed.) as well as changing the passwords on your social media and private email accounts (especially if you use the same passwords on these accounts.)

Please be careful out there. These criminals are now targeting the university, no doubt based on their past successes. Keep alert and on the lookout.

[Article by David Wiles]

A phishing attack on Stellenbosch University via an internal sun email address was launched this morning. See the example below. (links have been removed)

Please do not click on this email, do not fill in your personal information and delete the email immediately. If follow the link and supply your information, it will be used by phishing criminals to gain access to your bank details. See the example below.

If you have any inquiries, please let us know by logging a request on ServiceNow or calling our Service Desk at 808 4367. For more information on this and other phishing attacks, refer to our blog and Twitter account.

From:SU staff member <fakesustaffaddress@sun.ac.za>
Sent: Monday, 07 August 2017 07:24
Subject: IT HelpDesk With the strengthening off our security system and improving your mailing experience, We have detected your mail settings are out of date. To enhance computer system security and comply with federal audit requirements, ITS requires all Sever Users to update their account , kindly click ITS to update your account to the latest Outlook Web App. Sign in and automatically update your mailbox by filling out the requirements correctly.

With the strengthening off our security system and improving your mailing experience, We have detected your mail settings are out of date. To enhance computer system security and comply with federal audit requirements, ITS requires all Sever Users to update their account , kindly click ITS to update your account to the latest Outlook Web App. Sign in and automatically update your mailbox by filling out the requirements correctly.
___________________
Thanks
Sincerely,
ITS Service Desk
Click Here To Upadate with your correct Login Details.

This week’s Monday morning phishing scam is in the form of a rather poorly worded “WARNING” about exceeding the limit of your email.

The three exclamation marks (!!!) in the Subject line should immediately be a warning. Just because it comes from “Stellenbosch University Upgrade Team 2017” doesn’t guarantee that it is genuine!

Here is what the phishing email looks like (With the dangerous parts removed):

From: Stellenbosch University Upgrade Team 2017 [mailto:forged_address@webmail.co.za]

Sent: Monday, 24 July 2017 10:49 AM

Subject: Urgent Notification !!!

Urgent notification ,

You have exceeded your mail limit , Your account will be blocked from sending and receiving messages if your account is not been upgraded, upgrade your account free now Via the weblink Below :

http://dont_click.on.this.link

If your account have been upgraded please ignore this, this is for all student and stafs please Thank you.

Webmail © 2017

Email: forged_address@webmail.co.za

Here are # tips below can help you spot a  phishing scam:

1. Unofficial “From” address. Look out for a sender’s email address that is similar to, but not the same as, a company’s official email address. These email addresses are meant to fool you.
2. Urgent action required. Fraudsters often include urgent “calls to action” to try to get you to react immediately. Be wary of emails containing phrases like “your account will be closed,” “your account has been compromised,” or “urgent action required.” The fraudster is taking advantage of your concern to trick you into providing confidential information.
3. Generic salutation. Fraudsters often send thousands of phishing emails at one time. They may have your email address, but they seldom have your name. Be sceptical of an email sent with a generic greeting such as “Dear Customer” or “Dear Member”.
4. Link to a fake web site. To trick you into disclosing your user name and password, fraudsters often include a link to a fake web site that looks like (sometimes exactly like) the sign-in page of a legitimate web site. Just because a site includes a company’s logo or looks like the real page doesn’t mean it is!
5. Spelling errors, poor grammar, or inferior graphics.
6. Requests for personal information such as your password, user name, or bank account or credit card number. Legitimate companies will never ask you to verify or provide confidential information in an unsolicited email.
7. Attachments (which usually contain viruses, malware or ransomware).

If you have received mail that looks like this please immediately report it to the Information Technology Security Team using the following method:

Send the spam/phishing mail to the following addresses

help@sun.ac.za and sysadm@sun.ac.za as well.

Attach the phishing or suspicious mail on to the message if possible. There is a good tutorial on how to do this at the following link (Which is safe): http://stbsp01.stb.sun.ac.za/innov/it/it-help/Wiki%20Pages/Spam%20sysadmin%20Eng.aspx

1. Start up a new email addressed to sysadm@sun.ac.za (CC: csirt@sun.ac.za and help@sun.ac.za
2. Use the Title “SPAM” (without quotes) in the Subject.
3. With this New Mail window open, drag the suspicious spam/phishing mail from your Inbox into the New Mail Window. It will attach the email as an enclosure and a small icon with a light yellow envelope will appear in the attachments section of the New Mail.
4. Send the email.

If you did click on the link of this phishing spam and unwittingly give the scammers your username, e-mail address and password you should immediately go to http://www.sun.ac.za/useradm and change the passwords on ALL your university accounts (making sure the new password is completely different, and is a strong password that will not be easily guessed.) as well as changing the passwords on your social media and private email accounts (especially if you use the same passwords on these accounts.)

[Article by David Wiles]