Service Ticket #$5150$

Date: $\frac{9}{8}\frac{?}{2023}$

Submitted By: Jaelyn Morgan

Message: I received an email from what appeared to be one of our business partners. They were extremely friendly, referred to a recent dinner they had with our CEO, Mr$.$ Daniels, and mentioned there was a pending invoice on their end from us$.$ They indicated that given our close relationship and the importance of the upcoming project, the CEO suggested they reach out to me directly to sort this out. An hour later I received an email with a purchase order document attached. I clicked and opened it$.$ It was a document that asked me to verify banking information, which I provided. HELPI

Updated: $9/12/2023$ Notes $($Tier $1$ Support$)$: Looked at email message $-$ received from $$

jm@r$0$pnOtchconsulting.com $($Top Notch Consulting$).$

Diagnosis

Adversary Tactic

Mitigation

Service Ticket #$5253$

Date: $\frac{9}{13}\frac{?}{2023}$

Submitted By: Carly Levit

Message: I received an email from IT to install the remote app to fix my PC$.$ I had to ship out a few boxes, so I let the support person work as he was in a rush. When I came back my computer was on a pornography site and it keeps doing pop$-$ups. What were you fixing anyways?

Updated: $9/14/2023$ Notes $($Tier $1$ Support$)$: Found DNS $($hosts file$)$ to be misconfigured with malicious entries.

Diagnosis

Adversary Tactic

Mitigation

Service Ticket #$5259$

Date: $\frac{9}{16}\frac{?}{2023}$

Submitted By: Wyatt Artois

Message: I received a call from one of our vice presidents. Well, he said he was a vice president. He was a little angry for faxes not working. I$\text{'}$m new here and thought it was best to help him. He sent me a file he needed faxed ASAP. I opened it and there was no docurnent. It's weird, but every hour my applications close and my computer reboots. I keep losing my work!

Updated: $9/17/2023$ Notes $($Tier $1$ Support$)$: Found a script running in scheduled tasks to force a computer to restart.

Diagnosis

Adversary Tactic

Mitigation