SANS ISC: InfoSec Handlers Diary Blog - Targeting OWA users - A report from the Mailbag

• SANS Site Network
  • Current Site
  • Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

InfoSec Handlers Diary Blog

We received a report from Ted of an email campaign targeting OWA users that leads to malware infections, thanks Ted!

UPDATE:  Additional information has been provided, there are changing "Subject;" lines and changing obfuscated links for users.

UPDATE 2; ISC contributor Martin Ireland reports message mispelling - "If the OWA message received by server or a user is html text, the word "autentication" can be detected and user alerted, or message be deleted by server etc". Thanks Martin!

UPDATE 3; We've received a few more ISC contributor reports from targeted organizations, and contributor Andrew Yourtchenko had a comment for blacklist mainters and a pointer to a related post last year at Gary Warner's site. His comment was since the ISC "is probably frequented by those who handle these kinds of blacklists, may be useful to draw their explicit attention that there might be users reporting "goodsite.com" - and they should verify before blocking".

Ted's contribution;