<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Agency FB";
panose-1:2 11 5 3 2 2 2 2 2 4;}
@font-face
{font-family:"Brush Script Std";}
@font-face
{font-family:"\@MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:MiloOT-Ita;}
@font-face
{font-family:MiloOT;}
@font-face
{font-family:inherit;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
h1
{mso-style-priority:9;
mso-style-link:"Heading 1 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:24.0pt;
font-family:"Times New Roman",serif;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.Heading1Char
{mso-style-name:"Heading 1 Char";
mso-style-priority:9;
mso-style-link:"Heading 1";
font-family:"Times New Roman",serif;
font-weight:bold;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Good morning,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We have experienced heavy phishing traffic since yesterday afternoon, and have had reports that some employees have responded to the phishing emails. We continue to have phishing reports, but are now seeing subject lines change, and the
emails appear to come from UA email addresses, although they are being sent from India and other locations.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The phishing emails in question can be found on our phishing alerts page, hxxp://security.arizona.edu/phishing-alerts (copy and paste the URL into your browser, and replace “hxxp” with “http”).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If you receive any of these emails, please delete them from your inbox. If you responded to these emails in any way (e.g., clicking a link and entering your username and password), please contact your IT Support or the 24/7 IT Support
Center (520-626-8324) as soon as possible. If you have additional questions, please don’t hesitate to contact UA Information Security at
<a href="mailto:infosec@email.arizona.edu"><span style="color:#0563C1">infosec@email.arizona.edu</span></a>.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Sincerely,<o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:13.0pt;font-family:MiloOT-Ita;color:#0C234B">Teresa E. Banks<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:MiloOT;color:#0C234B">Manager, Information Security
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:MiloOT;color:#0C234B"> & Compliance Programs<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:MiloOT;color:#0C234B">UA Information Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:MiloOT;color:#0C234B">The University of Arizona<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:MiloOT;color:#0C234B"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:MiloOT;color:#0C234B">Email:
<a href="mailto:tbanks@email.arizona.edu"><span style="color:#0C234B">tbanks@email.arizona.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:MiloOT;color:#0C234B">Office: 520.621.8476<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:MiloOT;color:#0C234B">Cell: 520.909.6057<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:MiloOT;color:#0C234B">Web:
<a href="http://security.arizona.edu/"><span style="color:#0C234B">http://security.arizona.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="mso-element:para-border-div;border:none;border-bottom:dotted #D7B875 1.5pt;padding:0in 0in 9.0pt 0in;background:white">
<p class="MsoNormal" style="margin-bottom:11.25pt;mso-line-height-alt:21.0pt;background:white;vertical-align:baseline;border:none;padding:0in">
<span style="font-size:26.5pt;font-family:"Georgia",serif;color:#A71313;letter-spacing:-.6pt">4/13/16 IT Security immediately<o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-bottom:11.25pt;line-height:16.8pt;background:white;vertical-align:baseline">
<span style="font-family:"inherit",serif;color:black">UA Information Security received a phishing email report, where recipients are directed to click on a link and update their passwords.<br>
<br>
If you receive this email, please delete it from your inbox. If you clicked on the link or provided any information, please contact your local IT Support or the 24/7 IT Support Center (626-8324) as soon as possible.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:11.25pt;line-height:16.8pt;background:white;vertical-align:baseline">
<span style="font-family:"inherit",serif;color:black"> <o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:11.25pt;line-height:16.8pt;background:white;vertical-align:baseline">
<span style="font-family:"inherit",serif;color:black">Email text:<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:16.8pt;background:white;vertical-align:baseline">
<span style="font-family:"inherit",serif;color:black">_____________________________<br>
From: Wilson, Stephanie</span><b><span style="font-family:"inherit",serif;color:maroon;border:none windowtext 1.0pt;padding:0in"> <EMAIL ADDRESS REMOVED></span></b><span style="font-family:"inherit",serif;color:black"><br>
Sent: Wednesday, April 13, 2016 04:56<br>
Subject: IT Security immediately<br>
<br>
<br>
IT Security<br>
<br>
Password will expire please contact your help desk. by Click Here </span><b><span style="font-family:"inherit",serif;color:maroon;border:none windowtext 1.0pt;padding:0in"><URL REMOVED></span></b><span style="font-family:"inherit",serif;color:black"><br>
<br>
IT Security immediately <br>
________________________________________<br>
The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, transmission, re-transmission, dissemination or other use of, or taking of any action in reliance
upon this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="mso-element:para-border-div;border:none;border-bottom:dotted #D7B875 1.5pt;padding:0in 0in 9.0pt 0in;background:white">
<p class="MsoNormal" style="margin-bottom:11.25pt;mso-line-height-alt:21.0pt;background:white;vertical-align:baseline;border:none;padding:0in">
<span style="font-size:26.5pt;font-family:"Georgia",serif;color:#A71313;letter-spacing:-.6pt">4/13/16 Admin Desk Ticket - # HD79035187 Account Validation</span><span style="font-size:26.5pt;font-family:"Times New Roman",serif;color:#A71313;letter-spacing:-.6pt"></span><span style="font-size:26.5pt;font-family:"Georgia",serif;color:#A71313;letter-spacing:-.6pt"><o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="line-height:16.8pt;background:white;vertical-align:baseline">
<span style="font-family:"inherit",serif;color:black;border:none windowtext 1.0pt;padding:0in">UA Information Security received a phishing email report, where recipients are directed to click on a link to validate incoming emails.</span><span style="font-family:"inherit",serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:16.8pt;background:white;vertical-align:baseline">
<span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#222222;border:none windowtext 1.0pt;padding:0in">Email Text:</span><span style="font-family:"inherit",serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:16.8pt;background:white;vertical-align:baseline">
<span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#222222;border:none windowtext 1.0pt;padding:0in">From: do-not-reply </span><b><span style="font-family:"inherit",serif;color:maroon;border:none windowtext 1.0pt;padding:0in"><EMAIL ADDRESS REMOVED></span></b><span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#222222"><br>
<span style="border:none windowtext 1.0pt;padding:0in">Cc: </span><br>
<span style="border:none windowtext 1.0pt;padding:0in">Date: Wed, 13 Apr 2016 18:49:31 +0000</span><br>
<span style="border:none windowtext 1.0pt;padding:0in">Subject: Admin Desk Ticket - # HD79035187 Account Validation</span></span><span style="font-family:"inherit",serif;color:black"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.2pt;background:white;vertical-align:baseline">
<span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black;border:none windowtext 1.0pt;padding:0in">Dear User, </span><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black"><br>
<br>
<span style="border:none windowtext 1.0pt;padding:0in">We have placed a temporal hold on two incoming mails for your account</span><br>
<br>
<br>
<span style="border:none windowtext 1.0pt;padding:0in">due to insufficient validation</span></span><span style="font-size:12.0pt;font-family:"MS Gothic";color:black;border:none windowtext 1.0pt;padding:0in">。</span><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black;border:none windowtext 1.0pt;padding:0in"> </span><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black"><br>
<br>
</span><b><span style="font-size:9.5pt;font-family:"inherit",serif;color:white;border:none windowtext 1.0pt;padding:0in;background:#12A4EB">CONTINUE</span></b><b><span style="font-family:"inherit",serif;color:maroon;border:none windowtext 1.0pt;padding:0in"><URL
REMOVED></span></b><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black"><br>
<br>
</span><span style="font-size:12.0pt;font-family:"MS Gothic";color:black;border:none windowtext 1.0pt;padding:0in">一</span><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black;border:none windowtext 1.0pt;padding:0in">System Admin</span><span style="font-size:12.0pt;font-family:"MS Gothic";color:black;border:none windowtext 1.0pt;padding:0in">。</span><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black;border:none windowtext 1.0pt;padding:0in"> </span><span style="font-size:12.0pt;font-family:"Verdana",sans-serif;color:black"><br>
<br>
<span style="border:none windowtext 1.0pt;padding:0in">2016</span></span><span style="font-size:9.5pt;font-family:"Arial",sans-serif;color:#222222"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><i><span style="font-size:14.0pt;font-family:"Brush Script Std";color:#1F497D">Mario A. Marquez<br>
Systems Administrator Principal<br>
University of Arizona<br>
College of Agriculture and Life Sciences<br>
School of Plant Sciences<br>
<a href="http://www.plssupport.arizona.edu/"><span style="color:#0563C1">http://www.plssupport.arizona.edu/</span></a><br>
<a href="mailto:marquezm@email.arizona.edu"><span style="color:#0563C1">marquezm@email.arizona.edu</span></a></span></i></b><span style="font-size:14.0pt;font-family:"Brush Script Std";color:#1F497D"><br>
<b><i>Office 520-621-1257<br>
Cell 520-429-2902<o:p></o:p></i></b></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:#1F497D"><img border="0" width="198" height="96" id="Picture_x0020_1" src="cid:image001.gif@01D1963A.56FF3350" alt="UAriz-CALS-logo-247"></span><span style="font-size:14.0pt;font-family:"Agency FB",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>