Security information

We have received several inquiries like this.

"When browsing internet sites, screens such as "Access to this PC is blocked for security reasons" or "Windows was blocked due to suspicious activity" are displayed with alarm sounds."

Both will prompt you to call a phone number starting with 050, and when you call, you will be instructed to install remote control software or go to a convenience store to buy a prepaid card.
This is a support scam.

Virus infection warning and support phone number displayed
https://www.keishicho.metro.tokyo.jp/sodan/nettrouble/jirei/warning_screen.html

Click here for how to close the fake warning screen.
Microsoft :
https://news.microsoft.com/ja-jp/2021/01/29/210129-information/

If the display does not stop even after closing the browser, please contact SIT Center for Science Information.
How to contact us :
https://web.sic.shibaura-it.ac.jp/otoiawase?lang=en

We've received calls that suspicious emails with attachments were sent to SIT email addresses from 2020/07/08 1:55.

This attached file make your computer infected to ransomwarewhen you open the file.

When you receive this email, please delete the email WITHOUT open/download attached file.

When you inadvertently open the attached file, please call Center for Science Information!

Examples of Subject

• I like this photo
• I love this photo!
• Is this you?
• Is this your photo?
• Look at this photo!
• My favourite photo!
• Photo just for you
• You like this photo?
• You look good here
• Your new photo?

Examples of attatched file name
IMG[Numbers].jpg.js.zip

2020/04/21 From around 11:47, there were reports that the phishing emails of the Webmail-like system were distributed to multiple email addresses of our university.

If you enter your user name and password on this site, your authentication information may be exploited, which may lead to unauthorized access.

If you receive this email, please delete it without accessing the link.

If you accidentally enter your user name and password, please change your password and contact the Information Systems Division.

• Title

• Text example 1

• Phishing site screen

2020/04/19 From around 02:26 to around 02:30, and from around 04:04 to around 04:09, phishing e-mails disguised as the University's WebActive! Mail were scattered to multiple e-mail addresses. Was reported.

When you access the link in the body of the email, you will see a website that looks just like the University's Webmail system.

If you enter your user name and password on this site, your authentication information may be exploited, which may lead to unauthorized access.

If you receive this email, please delete it without accessing the link.

If you accidentally enter your user name and password, please change your password and contact the Information Systems Division.

• Title

• Text example 1

• Text example 2

• Phishing site screen

2020/04/15 From around 12:06, there were reports that phishing e-mails, which seem to be web mails, were distributed to multiple e-mail addresses of our university.

If you enter your user name and password on this site, your authentication information may be exploited, which may lead to unauthorized access.

If you receive this email, please delete it without accessing the link.

If you accidentally enter your user name and password, please change your password and contact the Information Systems Division.

• Title

• Text example

From around 2020/02/11 12:08, there were reports that phishing emails spoofing the University's WebActive! Mail were being scattered to multiple university email addresses.

When you access the link in the body of the e-mail, a site similar to the university's Web mail system will be displayed.

If you enter your username and password on this site, your credentials will be exploited and unauthorized access may be possible.

If you receive this email, please delete it without accessing the link.

If you accidentally enter your user name and password, change the password and contact the Information System Section.

• Subject

• Example text

• Phishing site screen

Around 8:30 2020/02/08 and around 12:31 2020/02/11 there have been reports that suspicious e-mails with emoticons in the subject and body have been scattered to multiple e-mail addresses of the University. did.

When the attached file is opened, it is infected with ransomware (NEMTY), the data is encrypted and a ransom is required.

If you receive this email, please delete the attachment without opening it.

If you accidentally get infected and your data is encrypted, please contact the Information Systems Section.

• Subject example
  :)
  ;)
  :-)
  ;-)
  :-D
  :D
  8-)
  8-D
  :*
  :-*

• Attachment file name
  PIC_Numbers_2020.zip
  IMGNumbers_jpg.zip

• Message displayed when infected with NEMTY ransomware

Report that phishing e-mails spoofing the University's WebActive! Mail are distributed to multiple e-mail addresses of the University around 2020/01/30 23:47 and 01/31 01: 20-02: 28 had.

When you access the link in the body of the e-mail, a site similar to the university's Web mail system will be displayed.

If you enter your username and password on this site, your credentials will be exploited and unauthorized access may be possible.

If you receive this email, please delete it without accessing the link.

If you accidentally enter your user name and password, change the password and contact the Information System Section.

• Subject

• Example text

• フィッシングサイトの画像

Since the end of August 2019, Emotet Malware has been in fashion in Japan. Emotet is malware that is often infected by opening Word files attached to e-mails.

If you get infected with Emotet, you will not only steal Outlook email information (email server authentication information, inbox email address, subject, etc.) but also to other malware (TrickBot, Ryuk ransomware, Ursnif banking malware, etc.) Additional infection may occur.

The stolen email information may be used to disseminate emails for spreading infection.

• Emotet and TrickBot information (Sophos)

Please note that the subject line of emails varies and some of them take the form of replies to stolen emails.

If you receive such an email, please do not open it and contact the Information Systems Division.

If you open it and activate the content, disconnect from the network immediately.

Please make sure that the anti-virus software on your device is operating correctly.

• Attached file example

件名の例

Around 2020/01/10 19: 40-19: 53, there were reports that phishing emails spoofing the University's WebActive! Mail were being distributed to multiple email addresses of the University.

When you access the link in the body of the e-mail, a site similar to the university's Web mail system will be displayed.

If you enter your username and password on this site, your credentials will be exploited and unauthorized access may be possible.

If you receive this email, please delete it without accessing the link.

If you accidentally enter your user name and password, change the password and contact the Information System Section.

• Subject

• Text

• Phishing site image