Following on from Employee News 11, which stressed the need for vigilance to foil hackers, ICT Services has been made aware that public sector organisations have been attacked by emails which appear to come from compromised accounts of nurseries and charities often located in the Aberdeen area.
The emails are directing users to a malicious website in an attempt to then harvest network credentials.
ICT Services are aware of phishing emails from these addresses:
- Thrivecovebay@thrivechildcare[.]com
- Bananamoon-denmore[.]co[.]uk
- Bananamoon-bridgeofdon[.]co[.]uk
- Linksnurserybalmedie[.]co[.]uk
- whenyouwish[.]org[.]uk
- SensationALL[.]org[.]uk.
The domains of the malicious websites - that we are aware of - are:
- globalwatkinsconcreteblockgroup[.]mebuinervamkt[.]vu
- cyberquantum[.]za[.]com
- [https://glivora[.]za[.]com/soa-doc/sharep-redirect%5b.%5dhtml]https://glivora[.]za[.]com/soa-doc/sharep-redirect[.]html.
ICT Services has blocked the affected domains and confirmed that – to date – no emails have been received from these senders, however, please be aware of the threat.
If you do receive such an email from another sender DO NOT OPEN IT – contact the ICT Service Desk IMMEDIATELY on the helpline 0141 578 8888.
Remember, every email should be considered a threat if you do not expect it.
If you receive any email to your work address which you think is suspicious, please DO NOT OPEN IT, but forward it to our spam email address – ukspam@fusemail.com. If you do open it and then realise it’s suspicious, please call the ICT helpline right away.
For further advice, please see Employee 11 – Stay cyber resilient - protect yourself, colleagues and your workplace.
Thanks,
Jamie Robertson
Chief Finance Officer, Executive Officer Finance and Digital Services
