{"id":770,"date":"2022-01-26T16:03:50","date_gmt":"2022-01-26T16:03:50","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/upozorenje-sire-se-mailovi-s-malicioznim-privitkom\/"},"modified":"2026-11-04T08:45:06","modified_gmt":"2026-11-04T08:45:06","slug":"upozorenje-sire-se-mailovi-s-malicioznim-privitkom","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/upozorenja\/upozorenje-sire-se-mailovi-s-malicioznim-privitkom\/","title":{"rendered":"UPOZORENJE! \u0160ire se mailovi s malicioznim privitkom!"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong><span class=\"has-inline-color has-vivid-red-color\">UPDATE 27.01.2022.<\/span><\/strong> Nove informacije ozna\u010dene su crvenim tekstom te je dodana analiza tvrtke INFIGO IS d.o.o.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nacionalni CERT zabilje\u017eio je pove\u0107an broj prijava <strong>phishing mailova koji imitiraju<\/strong><s><strong> Ministarstvo znanosti i obrazovanja i sli\u010dne <\/strong>institucije<strong>, CARITAS, zaposlenike CARNET-a, helpdesk@skole.hr, AZOO (Agencija za odgoj i obrazovanje), <\/strong><\/s><strong> <span class=\"has-inline-color has-vivid-red-color\">adrese elektroni\u010dke po\u0161te korisnika interneta u Hrvatskoj. Radi se o privatnim i poslovnim e-adresama.<\/span> <s>privatne korisnike te ciljaju korisnike CARNET mre\u017ee i obrazovne djelatnike <\/s> E-poruke sadr\u017ee maliciozne MS Excel, ZIP ili sli\u010dne datoteke.<\/strong><\/p>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-flow wp-block-group-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong><span class=\"has-inline-color has-vivid-red-color\">Prema nalazima tvrtke INFIGO IS d.o.o.<\/span><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span class=\"has-inline-color has-black-color\">Datoteka iz privitka - Excel dokument pokre\u0107e lanac koji nakon 4-5 koraka preuzima i instalira Emotet.<\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Preporuke:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Kod bilo kojeg korisnika gdje se ustanovi uspje\u0161no pokretanje excel datoteke iz privitka treba smatrati <strong>visoku razinu ugroze<\/strong>.<\/li><li>Napad izgleda kao <strong>globalna kampanja<\/strong>, a ne ciljani napad prema korisnicima.<\/li><li><strong>Preporuka je da se ovo ne ignorira<\/strong>.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Sandbox analiza Excel datoteke:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/app.any.run\/tasks\/65fd0ba0-d4c1-4db9-b5f7-cc0425da5166\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/app.any.run\/tasks\/65fd0ba0-d4c1-4db9-b5f7-cc0425da5166\/<\/a><\/li><li><a href=\"https:\/\/www.hybrid-analysis.com\/sample\/e5fcc11ea5de258ad006ac1f956849bc1507edc1e39829a6b0c547bdde723b9e\/61f27975e40dcc346b58dd99\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.hybrid-analysis.com\/sample\/e5fcc11ea5de258ad006ac1f956849bc1507edc1e39829a6b0c547bdde723b9e\/61f27975e40dcc346b58dd99<\/a><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Osnovne informacije o Emotetu i njegovim mogu\u0107nostima:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/attack.mitre.org\/software\/S0367\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/attack.mitre.org\/software\/S0367\/<\/a><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Final stage payload<\/em> pokazuje da ve\u0107ina antivirusnih programa potvr\u0111uje Emotet:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/www.virustotal.com\/gui\/file\/f46f39f1b8e6e809867fec749c3279db3e32b86605c76ef8bca9e255933de9e4?nocache=1\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.virustotal.com\/gui\/file\/f46f39f1b8e6e809867fec749c3279db3e32b86605c76ef8bca9e255933de9e4?nocache=1<\/a><\/li><\/ul>\n<\/div><\/div>\n<\/div><\/div>\n<\/div><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Po \u010demu mo\u017eete prepoznati la\u017ene poruke:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>La\u017eirana From: polja: <\/strong><ul><li>S lijeve strane polja po\u0161iljatelja nalazi se imitirana e-adresa osobe ili ustanove, a s desne strane naj\u010de\u0161\u0107e u zagradi neka strana adresa koja nije povezana s imitiranom adresom <\/li><li>Pro\u0161irite polje podataka o po\u0161iljatelju kako bi vam se prikazalo vi\u0161e podataka!<\/li><\/ul><\/li><li><strong>Naslovi poruka:<\/strong><\/li><li>Izgleda kao Re: ili Fw: (odgovor ili proslje\u0111ivanje e-poruke) <strong>na ve\u0107 postoje\u0107u komunikaciju<\/strong><ul><li>Re: upisi srednje.........<\/li><\/ul><ul><li>Fw: Bo\u017ei\u0107nica za 2021. godinu<\/li><\/ul><ul><li>Re: Bo\u017ei\u0107nica za 2021. godinu<\/li><\/ul><ul><li>Re: FW: UZ III_\u0161k_god_2019_2020_Obavijest \u0161kolama koje su dobile odluke o uklju\u010divanju pomo\u0107nika u nastavi<\/li><\/ul><\/li><li><strong>Maliciozni privitak:<\/strong><ul><li>Report.xls<\/li><li>file-272249982914.xls<\/li><li>Scan-51547.xls (VBA\/TrojanDropper.Agent.CKU)<\/li><li>4214_32001163584.zip (DOC\/TrojanDownloader.Agent.DSZ)<\/li><li>details_58949.xls<\/li><\/ul><\/li><li><strong>Tekst e-poruke<\/strong>:<ul><li>tekst poruke na engleskom jeziku<\/li><li>sadr\u017ei informacije o privitku i lozinki za otvaranje privitka<\/li><\/ul><\/li><\/ul>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af1a0747c055&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af1a0747c055\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2022\/01\/image-2.png\" alt=\"\" class=\"wp-image-109835\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><figcaption>PRIMJER TEKSTA U PORUCI<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Ako poruka sadr\u017ei indikatore sli\u010dnog tipa, proslijedite je u formatu .eml\/.msg na incident@cert[.]hr, kako bismo je mogli prijaviti izvoru.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Kod prijave incidenta potrebno je slijediti <a href=\"https:\/\/www.cert.hr\/kakoizvucizaglavlje\/\" target=\"_blank\" rel=\"noreferrer noopener\">upute<\/a> o dostavljanju zaglavlja poruke.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nacionalni CERT nagla\u0161ava da ako niste o\u010dekivali poruku od tog po\u0161iljatelja i\/ili sli\u010dnog sadr\u017eaja,&nbsp;obavezno provjerite vjerodostojnost poruke koriste\u0107i drugi komunikacijski kanal. <strong>Savjetujemo da nikad ne otvarate sumnjive privitke i ne odgovarate na poruke koje ne o\u010dekujete.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>UPDATE 27.01.2022. Nove informacije ozna\u010dene su crvenim tekstom te je dodana analiza tvrtke INFIGO IS d.o.o. Nacionalni CERT zabilje\u017eio je pove\u0107an broj prijava phishing mailova koji imitiraju Ministarstvo znanosti i obrazovanja i sli\u010dne institucije, CARITAS, zaposlenike CARNET-a, helpdesk@skole.hr, AZOO (Agencija za odgoj i obrazovanje), adrese elektroni\u010dke po\u0161te korisnika interneta u Hrvatskoj. Radi se o privatnim [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1130,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[23],"tags":[],"tema":[],"class_list":["post-770","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-upozorenja"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=770"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/770\/revisions"}],"predecessor-version":[{"id":1134,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/770\/revisions\/1134"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1130"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=770"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=770"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=770"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=770"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}