Targeted Phishing Campaign Delivers Ransomware to Teachers' Devices

Summary

Proofpoint researchers observed a spear-phishing campaign, “employer21,” targeting teachers. The emails appear to be from parents or guardians attempting to deliver a student’s assignment after issues submitting the assignment the “usual way.” A ZIP attachment accompanies the email and, if opened and macros are enabled, downloads ransomware. Though this campaign is limited in scale, it is likely that threat actors will continue to utilize themes that take advantage of the remote learning environment to create a sense of urgency and legitimacy in future campaigns.

Recommendations

The NJCCIC reminds users to exercise caution when clicking on links or opening attachments sent in emails from both trusted and unknown entities and verify the legitimacy of requests via a separate means of communication. Additionally, avoid enabling macros in documents unless there is a known use for this feature. Further information and indicators of compromise can be found in the Proofpoint blog post.