Return-Path: <1921889-490-1022@be5.maropost.com> Delivered-To: edward@transocean.com Received: from vps.transocean.com by vps.transocean.com (Dovecot) with LMTP id 4SqTNDqdpVl7EQAAInt2oQ for ; Tue, 29 Aug 2017 09:58:34 -0700 Return-path: <1921889-490-1022@be5.maropost.com> Envelope-to: edward@transocean.com Delivery-date: Tue, 29 Aug 2017 09:58:34 -0700 Received: from mta7168.mp2200.com ([162.247.117.168]:46390) by vps.transocean.com with esmtp (Exim 4.89) (envelope-from <1921889-490-1022@be5.maropost.com>) id 1dmjq8-0001CL-Aq for edward@transocean.com; Tue, 29 Aug 2017 09:58:34 -0700 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=default; d=knowbe4.com; t=1504025890; l=1; h=from:subject:date:to; bh=nR4OLZRZ0GUjrRPiikCTwjFrqv567Fsl8w66LhE1mcQ=; b=Hw6D5cDrISgypRdQ2SKEoWrfO2komaYuE6L7/P7GZeferuSCzljnKjbOLGPnz9b205HMfo 9VnlyVVtNoZBDOyRzj0hL2az3Lb0FMJG+ZXRmdDlYOhZURpqHJc0HJn58k7XYVN04V8RiL 0KtGtjAWdLL2lo4jmQBDkFEx9NNjpCk= Received: from [<1921889-490-1022@be5.maropost.com>] ([<1921889-490-1022@be5.maropost.com>] helo=) by 771426-mailer10 (envelope-from 1921889-490-1022@be5.maropost.com) (Jetsend MTA 0.0.1 with ESMTP; Tue Aug 29 11:14:42 EDT 2017 Date: Tue, 29 Aug 2017 11:14:41 -0400 From: CyberheistNews Flash Reply-To: feedback@knowbe4.com To: edward@transocean.com Message-ID: Subject: [ALERT] The IRS Issued An Urgent Warning Against An IRS / FBI-Themed Ransomware Phishing Attack Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_59a584e1aba44_5ba076fd89c4894913f9"; charset=UTF-8 Content-Transfer-Encoding: 7bit List-Unsubscribe: X-CampaignID: 490 X-Campaign-ID: 490 X-ContactID: 1921889 X-AccountID: 1022 X-Binding: 162.247.117.168 X-DkimDomain: knowbe4.com X-DkimSelector: default X-Feedback-ID: 490:Maropost X-Spam-Status: No, score=0.7 X-Spam-Score: 7 X-Spam-Bar: / X-Ham-Report: Spam detection software, running on the system "vps.transocean.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: This email was sent to &lt;b&gt;edward@transocean.com&lt;/b&gt; by &lt;b&gt;feedback@knowbe4.com&lt;/b&gt; Manage Subscriptions http://newsletter.knowbe4.com/a/1022/unsubscribe/490/1921889/cca4bff1658b608098a16141a469e5e8969afc7a 33 N Garden Ave, Suite 1200 Clearwater, FL 33755 USA Report Spam http://newsletter.knowbe4.com/a/1022/report_spam/490/1921889/cca4bff1658b608098a16141a469e5e8969afc7a [...] Content analysis details: (0.7 points, 3.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: irs.gov] 0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror) 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -0.0 SPF_PASS SPF: sender matches SPF record 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% [score: 0.4910] 0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted Colors in HTML 0.0 HTML_MESSAGE BODY: HTML included in message 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines X-Spam-Flag: NO ----==_mimepart_59a584e1aba44_5ba076fd89c4894913f9 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit This email was sent to &lt;b&gt;edward@transocean.com&lt;/b&gt; by &lt;b&gt;feedback@knowbe4.com&lt;/b&gt; Manage Subscriptions http://newsletter.knowbe4.com/a/1022/unsubscribe/490/1921889/cca4bff1658b608098a16141a469e5e8969afc7a 33 N Garden Ave, Suite 1200 Clearwater, FL 33755 USA Report Spam http://newsletter.knowbe4.com/a/1022/report_spam/490/1921889/cca4bff1658b608098a16141a469e5e8969afc7a ----==_mimepart_59a584e1aba44_5ba076fd89c4894913f9 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable [ALERT] The IRS Issued An Urgent Warning Against An IRS / FB= I-Themed Ransomware Phishing Attack
3D""
=
[ALERT] The IRS Issued An Urgent = Warning Against An IRS / FBI-Themed Ransomware Phishing Attack

WASHINGTON, August 28, 2017 =E2=80=94 The = Internal Revenue Service warned people to avoid a new phishing scheme tha= t impersonates the IRS and the FBI as part of a ransomware scam to take c= omputer data hostage.

The IRS said: "The scam email uses the emblems of both the IRS and the Fe= deral Bureau of Investigation. It tries to entice users to select a =E2=80= =9Chere=E2=80=9D link to download a fake FBI questionnaire. Instead, the = link downloads a certain type of malware called ransomware that prevents = users from accessing data stored on their device unless they pay money to= the scammers."


=E2=80=9CThis is a new twist on an old sch= eme,=E2=80=9D said IRS Commissioner John Koskinen. =E2=80=9CPeople should= stay vigilant against email scams that try to impersonate the IRS and ot= her agencies that try to lure you into clicking a link or opening an atta= chment. People with a tax issue won=E2=80=99t get their first contact fro= m the IRS with a threatening email or phone call."

I suggest you send employees, friends and family an email about this r= ansomware attack, you're welcome to copy/paste/edit:
=C2=A0
"Heads-up! The IRS is warni= ng against a new phishing scam that tries to make you download an FBI que= stionnaire. But if you click the link, your computer will be infected wit= h ransomware instead. The scam email uses the emblems of both the IRS and= the Federal Bureau of Investigation.

Remember that the IRS does not use email, text messages or social media t= o discuss personal tax issues, such as those involving bills or refunds. = THINK BEFORE YOU CLICK!


The IRS stated: "Victims should not pay a = ransom. Paying it further encourages the criminals, and frequently the sc= ammers won=E2=80=99t provide the decryption key even after a ransom is pa= id. Victims should immediately report any ransomware attempt or attack to= the FBI at the Internet Crime Complaint Center, www.IC3.gov. Forward any= IRS-themed scams to phishing@irs.gov."

Here is the official IRS Newsroom post:
https://www.irs.gov/uac/newsroom/irs-issues-urgent-warning-to-beware-irs-= fbi-themed-ransomware-scam
=C2=A0
Does *Your* Antivirus = block the latest Ransomware Strains?
How vulnerable is your network against = ransomware attacks?

Bad guys are constantly coming out with new versions of ransomware strain= s to evade detection. Is your network effective in blocking ransomware wh= en employees fall for social engineering attacks?

KnowBe4=E2=80=99s Ransomware Simulator "RanSim" gives you a quick look= at the effectiveness of your existing network protection.

Here's how RanSim works:

=E2=9C=94 100% harmless simulation= of a real ransomware infection

=E2=9C=94 Does not use any of your own files

=E2=9C=94 Tests 10 types of infection scenarios

=E2=9C=94 Just download the install and run it

=E2=9C=94 Results in a few minutes!


RanSim has been downloaded thousands of times and run against dozens o= f AV products. The results have been an eye opening experience for ma= ny IT pros. NOTE: RanSim was created for Windows-based workstation= s running Windows 7 or higher.

Download RanSim Now




Don't like to click on redirected buttons? Cut & Paste this link in y= our browser:
https://info.knowbe4.com/ransomware-simulator-tool-1chn
=C2=A0


Warm Regards,
Stu Sjouwerman
Founder & CEO
KnowBe4, Inc.

Twitter | LinkedIn | Google | YouTube
Copyright =C2=A9 2014-2017 KnowBe4, Inc. All rights reserved.<= /div>
=C2=A0
=C2=A0
=C2=A0 This email was sent= to edward@transocean.com by feedback@knowbe4.com

33 N Garden Ave, Suite 1200 Clearwater, FL 33755 USA
=C2=A0 		=C2=A0
----==_mimepart_59a584e1aba44_5ba076fd89c4894913f9--