Phishing Attacks Hit U.S. Government Agencies
| published August 3, 2015 |

By Thursday Review staff

The computer systems and email accounts of several federal government agencies and several large U.S. corporations have been the victims of email-based phishing campaigns. The campaigns came during the period from middle June through much of July, according to a news release provided by the National Cybersecurity & Communications Integration Center (NCCIC).

The Readiness Team at NCCIC received frequent reports of the phishing attacks through much of June and July, and discovered that the assaults were affecting systems which included Microsoft Windows, Adobe Flash Player, and Linux operating systems—operating systems and tools common to thousands of computers in government and many businesses.

“Phishing” is the name of a form of cyber-attack in which legitimate-looking emails encourage users to click, often on attached files or documents—which also appear to be genuine—in order for the intruder to gain access to the account. The phishing campaigns tracked in June and July of this year by NCCIC lured email users to click on website links or official attachments, in some cases to legitimate websites already infected. Once inside that user’s computer, the intruders exploited a vulnerability found in either Adobe Flash and gave attackers a side-door entry point into the larger network of computers and servers.

In another version of the attack, legitimate emails contained a Zip file (compressed file) which, once it was clicked by the user, activated the malicious code, again opening a portal for intruders to gain access to the entire network.

Officers with NCCIC stressed that user education is the key to the safety of larger computer systems and networks, and recommended regular employee training on how to use discretion when opening emails and clicking on attachments or files. Another tip: avoid altogether clicking on direct links to unfamiliar website when included or embedded in an email. Instead, verify the website separately—typically using your browser, or, better still, through a third party search engine such as Google. NCCIC also recommends that when in doubt, contact the helpdesk or tech support of the agency or business before opening suspicious emails.

Related Thursday Review articles:

China Hacks Federal Employee Records; Keith H. Roberts; Thursday Review; June 5, 2015.

Taxpayer Information Stolen From IRS; Keith H. Roberts; Thursday Review; May 27, 2015.