Ransomware Email Attempts from fake SARS.... BEWARE!

[LazyLion]

Geting these very frequently now.... Like several a day...
They look very legit, but are also very obviously fake...
The clues are...

1) They are coming to our companies ORDER email (Not our admin email)
2) They have a link that goes to an online fake PDF or hosted file download which (when resolved) is a ZIP File.
3) The Headers are spoofed, and although they appear to come from <[email protected]> actually come from bot servers.

The two bot servers we have detected (and added to our email block) are ...
botwtzma.documentacionlibre.com
npiipzhh.southmyf.com

 

[krieg]

If you see via in the address it's a scam.

 

[UB40]

If you see via in the address it's a scam.

I was not aware of this. Thank you

 

[backstreetboy]

If a PDF is attached as a URL it's a scam.

 

[supersunbird]

Wonder why the word Fiscal appears in these, like Fiscal Serial Number and Fiscal Assessment Report, did these scammers just decide it sounds cool or what?

 

[UB40]

Wonder why the word Fiscal appears in these, like Fiscal Serial Number and Fiscal Assessment Report, did these scammers just decide it sounds cool or what?

True, it is a yankee term, we dont even use that F word here

 

[LazyLion]

If you see via in the address it's a scam.

Yeah, but most people just stop reading at the [email protected]