[Tech-l] FW: Message from the MS-ISAC: Spear Phishing Targeting K-12 Transportation Administrators - TLP: AMBER

[Brian Hoehner]

Please see the phishing alert below from CISA.

Brian Hoehner
Director of Operations
Miami Valley Educational Computer Association (MVECA)
937-767-1468 x3119

[cid:image007.jpg at 01DA58EA.CB352420]



From: MS-ISAC Advisory <MS-ISAC.Advisory at msisac.org>
Sent: Monday, February 5, 2024 3:04 PM
To: MS-ISAC SOC <SOC at msisac.org>
Subject: Message from the MS-ISAC: Spear Phishing Targeting K-12 Transportation Administrators - TLP: AMBER

TLP: AMBER

DATE: February 5, 2024


CISA has received a tip from a trusted third party regarding a spear phishing campaign targeting K-12 transportation administrators. The unknown threat actor has been seen sending fake Department of Transportation forms requesting that drivers update their information. These forms are prefilled with publicly available information to appear legitimate.

The emails may potentially be sent from trinitymarshall[.]net email addresses, a network associated with these spear phishing emails, but may be sent by other sources.

To report incidents and anomalous activity, please contact either of the following organizations:

  *   CISA’s Incident Reporting System<https://www.cisa.gov/forms/report> or through the agency’s 24/7 Operations Center at report at cisa.gov<mailto:report at cisa.gov> or (888) 282-0870.
  *   MS- and EI-ISAC, through their 24/7 Operations Center<https://www.cisecurity.org/isac/report-an-incident> at soc at msisac.org<mailto:soc at msisac.org> or (866) 787-4722.


Multi-State Information Sharing and Analysis Center (MS-ISAC)
Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC)
31 Tech Valley Drive
East Greenbush, NY 12061

24x7 Security Operations Center
SOC at cisecurity.org<mailto:SOC at cisecurity.org> - 1-866-787-4722
[cid:image001.png at 01DA5844.101E1BC0]<https://www.cisecurity.org/isac/>
             [cid:image002.png at 01DA5844.101E1BC0] <https://www.linkedin.com/company/the-center-for-internet-security/>  [cid:image003.png at 01DA5844.101E1BC0] <https://twitter.com/CISecurity>  [cid:image004.png at 01DA5844.101E1BC0] <https://www.facebook.com/CenterforIntSec>  [cid:image005.png at 01DA5844.101E1BC0] <https://www.youtube.com/user/TheCISecurity>  [cid:image006.png at 01DA5844.101E1BC0] <https://www.instagram.com/cisecurity>

TLP: AMBER
https://www.cisa.gov/tlp
Limited Disclosure, restricted to participants' organizations. Recipients may only share TLP: AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm.

Please send all opt out requests to info at cisecurity.org<mailto:info at cisecurity.org>.

This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments.

This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments.

. . . . .
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20240206/ec15f5a3/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 14917 bytes
Desc: image001.png
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20240206/ec15f5a3/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 2151 bytes
Desc: image002.png
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20240206/ec15f5a3/attachment-0007.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 2332 bytes
Desc: image003.png
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20240206/ec15f5a3/attachment-0008.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image004.png
Type: image/png
Size: 1984 bytes
Desc: image004.png
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20240206/ec15f5a3/attachment-0009.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image005.png
Type: image/png
Size: 1847 bytes
Desc: image005.png
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20240206/ec15f5a3/attachment-0010.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image006.png
Type: image/png
Size: 3496 bytes
Desc: image006.png
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20240206/ec15f5a3/attachment-0011.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image007.jpg
Type: image/jpeg
Size: 3473 bytes
Desc: image007.jpg
URL: <http://listserv.mveca.org/pipermail/tech-l/attachments/20240206/ec15f5a3/attachment-0001.jpg>