Spamming of NANOG list members

[fergdawgster at mykolab.com (Paul Ferguson)]

On 5/31/2019 8:05 PM, Richard wrote:

> On 5/31/19 8:07 PM, Niels Bakker wrote:
>> * bryan at shout.net (Bryan Holloway) [Sat 01 Jun 2019, 01:54 CEST]:
>>> Anybody else noticed a significant uptick in these e-mails?
>>>
>>> When I first saw this thread, I hadn't seen any. A couple days later,
>>> I got my first one. (yay!) Now I'm getting 2-3 a day. (yay?)
>>
>> Yes.  It's pretty annoying.  And somebody seems to be burning through
>> a lot of stolen credentials.  I wonder what the success rate is...
>>
>>
>> Â Â Â Â -- Niels.
>>
>>
> Â Â Â  I am getting several a day as well as ugly MS Word based trojan.
> 
> Â Â Â  They come to me from all over the world with the subject line:
> 
> Â Â Â  "NANOG Payment Remittance Advice"
> 
> Â Â Â  I agree with Niels, someone or some spamming outfit is burning
> 
> Â Â Â  through quite a bit of stolen credentials.
> 
> Â Â Â  Richard Golodner
> 
> Â Â Â  Infratection
> 


It's Emotet (again).

Cheers,

- ferg


-- 
Paul Ferguson
Principal, Threat Intelligence
Gigamon
Seattle, WA  USA