Should be from Jim
Jim
--
[image: suu.edu] <https://www.suu.edu/> JIM SHAKESPEAR | Chief
Information Security Officer / Director of IT Security / Institutional Data
Privacy Officer
INFORMATION TECHNOLOGY, SOUTHERN UTAH UNIVERSITY
ELC513 <https://map.concept3d.com/?id=821#!m/129644?s/> | (435) 865-8202
Testing a normal send with the lists test group.
Jim
--
[image: suu.edu] <https://www.suu.edu/> JIM SHAKESPEAR | Chief
Information Security Officer / Director of IT Security / Institutional Data
Privacy Officer
INFORMATION TECHNOLOGY, SOUTHERN UTAH UNIVERSITY
ELC513 <https://map.concept3d.com/?id=821#!m/129644?s/> | (435) 865-8202
--
[image: suu.edu] <http://www.suu.edu/> James Loveland | Systems
Administrator
INFORMATION TECHNOLOGY
SOUTHERN UTAH UNIVERSITY
ELC 511 | 351 W. UNIVERSITY BLVD, CEDAR CITY, UT 84720
P (435) 865-8744 | E loveland(a)suu.edu
All,
During the past few weeks, we have seen a significant uptick in phishing
emails (we've had 3 of the below examples today). We anticipate these
phishing emails will continue through the holiday season. To report any
phishing or unwanted emails, please use our PhishAlarm tool (
https://my.suu.edu/help/article/3824/report-unwanted-and-malicious-emails/)
As a backup/alternative, you may email phish(a)suu.edu.
Attackers have gained access to email accounts from *outside of SUU* and
use the document sharing features of Google Drive and Office 365 (OneDrive)
to share documents with our @suu.edu email addresses.
Typical emails you will receive look like the following (with highlights to
identify the email may be an attack):
[image: image.png]
Some indicators to look for to determine if the shared document is
legitimate or not are:
- Is the shared document something I was expecting?
- Is the document shared by someone in our organization or an
organization I work with frequently?
- Is there a comment leading me to believe someone at SUU is sharing a
document with me (Mindy Benson example above)?
If you open the shared document, most of these attacks open a document in
Google Drive or Microsoft OneDrive. The Shared Document typically isn't
malicious, but leads you to believe you need to authenticate somewhere
else. An example can be found below.
[image: Google Doc redirect to Google Form.png]
If you open a Google Document similar to the one above, please open the
Help menu and select "Report Abuse" (see image below). This will notify
Google of an attack and they will eventually review the document to remove
it for Phishing.
[image: Help -> Report Abuse menu item]
If you followed the link in the Shared document, we have typically seen a
Google Form, or a copied website looking like our MySUU portal login page.
The Google Form example is below. *Never submit passwords in a form.*
[image: Google Form asking for email-password.png]
You may also notice a "Report Abuse" link at the bottom of the form. Please
report the abuse to Google as a phishing page if you already got this far
in the phishing process.
*If* you have submitted your password in a Google Form (especially in the
past month), *please change your password immediately.*
Feel free to reach out to our Help Desk (865-8200 or support(a)suu.edu) if
you need help changing your password.
Thanks,
Jim
--
[image: suu.edu] <https://www.suu.edu/125/> Jim Shakespear | Director
of IT Security
INFORMATION TECHNOLOGY, SOUTHERN UTAH UNIVERSITY
ELC 513 | (435) 865-8202
d
--
[image: suu.edu] <http://www.suu.edu/> James Loveland | Systems
Administrator
INFORMATION TECHNOLOGY
SOUTHERN UTAH UNIVERSITY
ELC 511 | 351 W. UNIVERSITY BLVD, CEDAR CITY, UT 84720
P (435) 865-8744 | E loveland(a)suu.edu
d
--
[image: suu.edu] <http://www.suu.edu/> James Loveland | Systems
Administrator
INFORMATION TECHNOLOGY
SOUTHERN UTAH UNIVERSITY
ELC 511 | 351 W. UNIVERSITY BLVD, CEDAR CITY, UT 84720
P (435) 865-8744 | E loveland(a)suu.edu
d
--
[image: suu.edu] <http://www.suu.edu/> James Loveland | Systems
Administrator
INFORMATION TECHNOLOGY
SOUTHERN UTAH UNIVERSITY
ELC 511 | 351 W. UNIVERSITY BLVD, CEDAR CITY, UT 84720
P (435) 865-8744 | E loveland(a)suu.edu
test
--
[image: suu.edu] <http://www.suu.edu/> James Loveland | Systems
Administrator
INFORMATION TECHNOLOGY
SOUTHERN UTAH UNIVERSITY
ELC 511 | 351 W. UNIVERSITY BLVD, CEDAR CITY, UT 84720
P (435) 865-8744 | E loveland(a)suu.edu
d
--
[image: suu.edu] <http://www.suu.edu/> James Loveland | Systems
Administrator
INFORMATION TECHNOLOGY
SOUTHERN UTAH UNIVERSITY
ELC 511 | 351 W. UNIVERSITY BLVD, CEDAR CITY, UT 84720
P (435) 865-8744 | E loveland(a)suu.edu
