Dispatches From The Geeks

News and Announcements from the MCS Systems Group

Email phishing attempt

I could write more on this, but Hunter’s message to his group covers the salient points. Thanks to all who reported it.

> All,
> Two of you have reported the rather sad phishing attempt included below. (Thank you for reporting this to me – please feel free to > include cyber@anl.gov in future reports).
> Naturally none of you will fall for this kind of thing, but for the benefit of our newer members I thought I’d go over a couple points that give this kind of thing away: >
> 1. While it says “Argonne National Laboratory” the users return email has nothing to do with the lab. (in this case atlanticbb.net)
> 2. The grammar and spelling is terrible. While not all lab communications were written by Shakespeare, the staff here are generally far more eloquent than this. > 3. The URL you are directed to go to has no relation to any lab web address.
> 4. The word login is hyphenated – this is almost a dead giveaway that its bogus as the phishers know that any incoming email with the word “login” spelled correctly will probably get hung up in the spam/phish filters. >
> Unfortunately on occasion the lab will use outside vendors/tools/collaboration sites that are not “anl.gov” or a related site and are yet legitimate. I can assure you that this makes the sysadmins in general and the cyber security folks in particular very unhappy. >
> Naturally if you ever are in doubt about something being legit please feel free to ask any of the sysadmins around – we’ll either know already from other reports or we’ll find out for you. >
>> From: “Argonne National Laboratory” >> Date: April 25, 2013, 17:27:24 CDT
>> To: undisclosed-recipients:;
>> Subject: Hello
>> Your two incoming mails is on pending status due to our recent database upgrade Click,
>> [redacted] to lo-gin for online account upgrade and await Argonne National Laboratory for response,we >> apologies for any inconvenience and appreciate your understanding. >>
>> Sign
>> Ercoli Tracy Lavaan
>> 9700 S. Cass Avenue
>> Argonne IL 60439
>> Phone:630 252-2000
>> Argonne National Laboratory


Written by Craig Stacey

April 25, 2013 at 11:13 pm

Posted in Uncategorized

%d bloggers like this: