<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Brush Script MT";
panose-1:3 6 8 2 4 4 6 7 3 4;}
@font-face
{font-family:"Agency FB";
panose-1:2 11 5 3 2 2 2 2 2 4;}
@font-face
{font-family:"Brush Script Std";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1027" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><i><span style="font-size:14.0pt;font-family:"Brush Script Std";color:#1F497D">Mario A. Marquez<br>
Systems Administrator Principal<br>
University of Arizona<br>
College of Agriculture and Life Sciences<br>
School of Plant Sciences<br>
<a href="http://www.plssupport.arizona.edu/">http://www.plssupport.arizona.edu/</a><br>
<a href="mailto:marquezm@email.arizona.edu">marquezm@email.arizona.edu</a></span></i></b><span style="font-size:14.0pt;font-family:"Brush Script Std";color:#1F497D"><br>
<b><i>Office 520-621-1257<br>
Cell 520-429-2902<o:p></o:p></i></b></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#1F497D"><img border="0" width="198" height="96" id="Picture_x0020_1" src="cid:image003.gif@01D19599.81B6A2A0" alt="UAriz-CALS-logo-247"></span><span style="font-size:14.0pt;font-family:"Agency FB",sans-serif;color:#1F497D"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> CalsNetMgrs [mailto:calsnetmgrs-bounces@list.cals.arizona.edu]
<b>On Behalf Of </b>Rahr, Matt - (rahr)<br>
<b>Sent:</b> Wednesday, April 13, 2016 3:30 PM<br>
<b>To:</b> 'calsnetmgrs@list.cals.arizona.edu' <calsnetmgrs@list.cals.arizona.edu><br>
<b>Subject:</b> [CalsNetMgrs] FW: Phishing email today<br>
<b>Importance:</b> High<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Please distribute to your users.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks,<br>
Matt<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">
<a href="mailto:itsecmgrs-request@list.arizona.edu">itsecmgrs-request@list.arizona.edu</a> [<a href="mailto:itsecmgrs-request@list.arizona.edu">mailto:itsecmgrs-request@list.arizona.edu</a>]
<b>On Behalf Of </b>Salazar, Gil - (gsalazar)<br>
<b>Sent:</b> Wednesday, April 13, 2016 3:23 PM<br>
<b>To:</b> <a href="mailto:itsecmgrs@list.arizona.edu">itsecmgrs@list.arizona.edu</a><br>
<b>Subject:</b> [itsecmgrs] Phishing email today<br>
<b>Importance:</b> High<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hello all,<o:p></o:p></p>
<p class="MsoNormal">There was an active phish campaign going on today. With the subject of (Admin Desk Ticket - # HD79035187 Account Validation) .<o:p></o:p></p>
<p class="MsoNormal">We have had a few people we know of respond to the emails and have had the NETID compromised. FireEye shows an uptick in accounts logging in to UAaccess employee from Nigeria and other foreign countries within the past 12 hours. We will
be shutting down some of those to protect their assets in employee uaccess.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The phish email has been blocked in IronPort but unfortunately 6500+ have gone out. So let your folks beware of this and remind them not to follow these links asking for account info.<o:p></o:p></p>
<p class="MsoNormal">One step forward, two back. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:16.0pt;font-family:"Brush Script MT";color:#002060">Gil Salazar</span><span style="font-size:16.0pt;font-family:"Brush Script MT";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><!--[if gte vml 1]><v:shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">
<v:stroke joinstyle="miter" />
<v:formulas>
<v:f eqn="if lineDrawn pixelLineWidth 0" />
<v:f eqn="sum @0 1 0" />
<v:f eqn="sum 0 0 @1" />
<v:f eqn="prod @2 1 2" />
<v:f eqn="prod @3 21600 pixelWidth" />
<v:f eqn="prod @3 21600 pixelHeight" />
<v:f eqn="sum @0 0 1" />
<v:f eqn="prod @6 1 2" />
<v:f eqn="prod @7 21600 pixelWidth" />
<v:f eqn="sum @8 21600 0" />
<v:f eqn="prod @7 21600 pixelHeight" />
<v:f eqn="sum @10 21600 0" />
</v:formulas>
<v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect" />
<o:lock v:ext="edit" aspectratio="t" />
</v:shapetype><v:shape id="Picture_x0020_3" o:spid="_x0000_s1026" type="#_x0000_t75" alt="wildcat" style='position:absolute;margin-left:-12.3pt;margin-top:-91.3pt;width:33.35pt;height:33.35pt;z-index:-251658752;visibility:visible;mso-wrap-style:square;mso-width-percent:0;mso-height-percent:0;mso-wrap-distance-left:9pt;mso-wrap-distance-top:0;mso-wrap-distance-right:9pt;mso-wrap-distance-bottom:0;mso-position-horizontal:absolute;mso-position-horizontal-relative:text;mso-position-vertical:absolute;mso-position-vertical-relative:text;mso-width-percent:0;mso-height-percent:0;mso-width-relative:page;mso-height-relative:page'>
<v:imagedata src="cid:image001.gif@01D19598.4D61AEB0" o:title="wildcat" />
<w:wrap type="square"/>
</v:shape><![endif]--><![if !vml]><img width="44" height="44" src="cid:image004.jpg@01D19599.81B6A2A0" align="left" hspace="12" alt="wildcat" v:shapes="Picture_x0020_3"><![endif]><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:navy">Intermin
Deputy Information Security Officer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:navy">University of Arizona<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:navy">520-626-3651<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>