Spear Phishing is Getting Creative

I was on a customer network today doing some tuning and training using NetWitness and saw a very interesting spearphishing email to five customer employees. The forged email source was from the “Fire Inspector General” of the corporation and it urged the recipients to open the attached file to complete their training. It was a Thursday and the email warned that there would be a mandatory pop quiz on Monday. That file was a trojanized PDF document that was unrecognizable by Virustotal.

So watch out for emails from Fire Marshall Bill.