//Blogs - 20 Oct 2022
RECENT TARGETS
AusCERT has been receiving reports of various RFQ scams spoofing Australian Universities and targeting vendors via the spoofed domain.
THE TRIED AND TESTED METHOD
A scammer creates an identical-looking domain impersonating a university. The spoofed domain with active MX records is then used to send emails to various vendors asking for quotes for the products they sell. The MX record allows email replies to be directed back to the scammer. The email address usually impersonates a staff member on the executive level. In some cases, the emails may be blocked or quarantined depending on the vendor’s security policy. Hence, small, and medium-sized companies are targeted as they might have a lower maturity level in their security policies. When such reports are sent to AusCERT, it can be acted upon quickly if we are provided with email headers as evidence, and the domain registrar will usually suspend the domain successfully with such details.
HOW IT HAS CHANGED
Some scammers have now changed their methods of delivering such RFQ scams. To avoid the quarantine of emails and to avoid being taken down by the registrar (as the registrar usually requires email headers in such cases), scammers now use the built-in web forms located on the websites of small-medium-sized companies. The submitted email address is an address from the spoofed domain. In such cases, it is difficult for the targeted university to reach out to the companies asking for more information.
Furthermore, since no email headers are recorded, submitting a takedown request to the domain registrar is difficult without much evidence.
WHAT THE UNIVERSITY CAN DO
Submit as much information as possible in such a situation. It is also recommended that the university should also reach out to the company that communicated with the scammer to obtain any related information. For e.g., the webform chat in this case. If the university is unable to contact the vendor, AusCERT might be able to assist.
