UW-Platteville Outages

[Initial Report]

We have reports of three phishing attempts, all claiming to be from various UW-Platteville account holders (though the “From” addresses give them away). KUDOS to the dozens of folks who identified the phishes, forwarded them to the ITS Help Desk to verify first, then sent the emails “over the dam” to their trash.  

Individual phish details are included below. Biggest clues?
•    Microsoft’s notice, “You don’t often get email from [this address]….” While messages claimed to be from UW-

Platteville account holders, the “From” addresses were not uwplatt (Gmail, iCloud)
•    Does this message -- from this person -- at this time -- make sense?
•    Were you expecting a message/attachment from this person?

What to do

Always verify first then trust. Contact the alleged sender via other means (phone call) or report to the ITS Help Desk.

•    If you receive any of these messages from the SAME alleged senders, please DELETE.
•    If you receive any of these messages from DIFFERENT alleged senders, please REPORT to the ITS Help Desk at helpdesk@uwplatt.edu.
•    If you responded to any of these messages, please CHANGE your password and contact the ITS Help Desk for further instruction.

The Details

Subject: Fwd: [NAME – see list below] shared a Document with you
From address: Cheryl.kik@fmsd.org
[NAME] sent an item
•    Dr. Tera L Montgomery
•    Dr. Katherine C Rabidoux
•    Dr. Jodi Prosise
•    Dr. Leslie A Hollingsworth
•    Dr. Barb Barnet
•    Wayne C Weber
•    Dr. Charles R Cornett
•    Stacia Stephenson
•    Michael Knipe

Specific clues this is not legit:
•    Includes unexpected attachment.
•    “Sender’s” name does not match “From”.
•    “From” address is unfamiliar, NOTE: “You don’t often get…”
•    Hover over “block the sender” reveals totally different email addresses than “From” or the alleged sender.

Subject: [No Subject]
From: random addresses @icloud.com, claiming to be
•    Jodi Prosise
•    Charles Cornett
•    Travis Nelson
•    Les Hollingsworth
•    Tera Montgomery
•    Richard Dhyanchand

Classic spear phishing! Specific clues this is not legit:
•    Brief message, “Available? Cell phone number?” with sense of urgency.
•    Allegedly from someone you know/trust – always verify first!
•    For more spear phishing clues, see Security—Spear Phishing in the ITS Knowledge Base.

Subject: Disposal of Welding Machine and Tools Box
From: “Alison Parkins”, UW-Platteville Public Information Officer, with a Gmail address
Message claims “Mrs. Anne-Marie A Lerner” wants to donate her late father’s welding equipment.  Clues this is not legit:

•    Doesn’t make sense. The PIO does not send “items for sale/donation” messages to campus.
•    The named Gmail address does not match Alison’s name.
•    Plays on your sympathies.
•    Suspicious: You are asked to use your personal email and reply to yet another address (Outlook.com) that does match anyone mentioned.