Security Advisory

Phishing remains a persistent and pervasive threat to all organizations. While the University of Regina has many security measures in place to block unwanted emails, threat actors are always looking for ways to trick you into clicking links and providing personal information.

A resurgence of an old technique has been observed at the University of Regina recently called 'Email Reply Chain Attacks.' What sets this phishing campaign apart is that the body of the email contains a legitimate past email thread that you may have been part of. This is done in an effort to lend credibility to the message and make it look more legitimate. This old email information is typically acquired by a threat actor that has compromised the account of someone on the email trail. The message will typically contain a malicious link or document in hopes you will trust the email enough to click the link or open the document.

What to Look For

• Check the date of the email thread. If it is old, it is likely not legitimate.
• It is confusing to be added to an old email thread. This is the desired effect threat actors are seeking.
• In this case, the messages claimed to be from someone at the University but were sent by an external sender.
• Never open attachments from unknown senders. Because the email thread is hijacked, the sender is unknown.
• Be cautious of any email you receive with a warning banner attached (i.e. indicating it is from an external source).
• Always check the sender's email address to ensure it matches the organization from which it claims to be sent from.
• Be wary of urgent requests for personal information or to perform a task with severe or unrealistic consequences for inaction.
• Hover over any embedded links or URLs in the message to ensure they lead to a legitimate and expected location
• Watch for spelling and grammar errors evident in the email.

Impact

Resolution

Resources