UW-Platteville Outages

[Initial Report]

The ITS Help Desk experienced its own version of Cyber Monday this morning in the form of at least six different phishing attempts, including two that claimed to offer financial aid funds/refunds. These are all scams.

• If you receive one of the messages listed below, please REPORT the message as "phishing" in OWA or Outlook; this notifies Microsoft, triggers internal processes, and moves the message to your Deleted Items.
• If you receive a similar email from another sender or subject, please FORWARD the original email to the ITS Help Desk using the steps below. They are responsible for documenting the incidents, monitoring the breadth of the attack, and mitigating risk when possible.
• Click forward on the suspicious email.
• Add "phish" to the front of the subject.
• Send to the ITS Help Desk at helpdesk@uwplatt.edu. 
• IN ADDITION: In Office 365/Outlook, REPORT the message as "phishing"; this notifies Microsoft, triggers internal processes, and moves the message to your Deleted Items.
• If you responded to any of the messages below and provided information, CHANGE your password AND challenge response questions IMMEDIATELY and contact the ITS Help Desk for further instructions. 

Subjects (2): Financia [sic] aid; Activate your Refund Student

Alleged sender of both: "Benjamin Blazhovec" at a uwplatt address

Both reference Bank Mobile and include links to forms on godaddysites.

Things to note

• Official instructions for refunds are only available at:
• Cashier’s Office Refunds
• PASS Refund Setup Guide
• You will only ever be asked to enter your bank account information in PASS—never on any other website.
• Message comes from a student account.
• Includes grammar/spelling errors.
• UW-Platteville has not used Bank Mobile for five years or more.

Subjects (3): Attention Student; Work opportunity; Work from home

Sender addresses from .cz domain (Czech Republic)

All messages were blank.

Work emails included attachments (.rtf).

Things to note

• Do you know anyone in the Czech Republic? Do not respond.
• Does it make sense to receive this message from this sender through this medium at this time? Do not respond.
• Are you expecting an attachment? Do not open.

Subject: Dear Staffs and Student Activate Your Account

Alleged sender: "Dalton S Birkrem" with a uwplatt account.

Claims your account has been "flagged for deactivation due to retirement, graduation, or transfer".

Includes link to cricket application form.

Things to note

• Account provisioning at UW-Platteville happens automatically; you do not need to do anything.
• Message comes from a student account.
• Message includes grammar/spelling errors.

 If you have questions about these or any suspicious messages in your uwplatt account, please FORWARD the message to the ITS Help Desk at helpdesk@uwplatt.edu. 

And as always, remember: ITS does not text! ITS will never ask for your password on the phone, in person, in an email, or in a form in an email. Never, ever. Seriously!