The Anti-virus Times

Thursday, April 8, 2021

As our regular readers already know, Doctor Web’s experts recently analysed an attack that was carried out against Russia's critical infrastructure entities. This attack supposedly came from China. Here is our previous issue on this topic. Perhaps some facts escaped your notice when reading these materials. Let's recall:

These quotations show that:

• fraudsters use domains whose names are disguised as news-related names;
• these domains are not the ones frequently used by ordinary employees. How many people actually read news posts on the Microsoft website?

And here is a question for you: does anything here get your attention? Did you notice that the second domain is not "microsoft" but "microotf"? It's not obvious at first glance, and to his great embarrassment, the author of this issue initially missed that fact  But, after all, this is a known fraudulent trick designed to capitalise on user carelessness. Clearly fraudsters are unlikely to hijack a domain belonging to Microsoft.

But let's get back to the topic of this issue. Do all employees need to be open to the outside world? For example, purchase managers and sales managers, just like an administrative office, should receive all their emails. Naturally with a note as to whether a message is spam, but they do need to receive all emails, with no exceptions.

But, warehouse workers don’t; they receive their emails via internal mail. Similarly, the accounting department most likely communicates with organisations from a known list.

Email restrictions can also be set according to their country of origin: for example, you can configure restrictions to receive emails from Russia only. The country of origin for an email is defined by the IP address of the sender and not by any characteristics specified in the message.

#VCI #corporate_security #fraudulent_email #Dr.Web_settings #email #spam #phishing