Re: Unusual pattern of compromised accounts

[Andy Hooper <hooper () QUEENSU CA>]

The payroll direct deposit attack is not unusual. Some make the
newspapers, e.g. Boston and Calgary. The attackers may save up the
passwords for a while before use. Watch for IP addresses that log in to
more than one user name.

- Andy Hooper - IT Services - Queen's University -

Pollock, Joseph wrote on 2018-01-26 4:17 PM:
> Has anyone observed the following:
>
>  
>
> 1.        A cluster of compromised accounts with no indication of a
> common factor such as clicking on a phishing link. Users have no idea
> how the compromise occurred.
>
> 2.       The culprits change the user’s direct deposit authorization
>
> 3.       They may have been familiar with the Banner system.
>
> 4.       No other activity was observed.
>
>  
>
> We are looking for other indications,  such as compromised desktops, 
> but have found nothing as yet.
>
>  
>
> Please reply outside the list if you wish.
>
>  
>
> Joe Pollock
>
> Network Services
>
> The Evergreen State College