Story image

Australian businesses targeted by ASIC impersonation fraud

13 Mar 2017

MailGuard recently warned of a new phishing scam using false ASIC credentials, which installs malware on unsuspecting victims’ computers.

The email looks to be from the Australian Securities and Investment Commission (ASIC) and tricks users into clicking links that then install ransomware.

The message from ‘ASIC Messaging Service’ demands victims must renew their company name by clicking a link. 

To add to the false sense of genuine intentions, the email uses government logos and a fake signature from a phony employee called ‘Max Morgan, Senior Executive Leader’ at ASIC. But there is nobody by that name at the company.

Those who click the link are also informed that if they don’t need to register their business name, they can email bncancel@asic,gov.au, ASIC’s genuine cancellation email address.

The emails, which affected ‘tens of thousands’ of email addresses, originated from a newly registered domain (asic-gov-au.co) in China. The domain is also vastly different to the asic.gov.au official domain.

MailGuard says the link wasn’t being detected as suspicious on any of the antivirus engines listed on VirusTotal. The attack is the second large-scale fraud attack this year, after a similar one occurred in January.

ASIC has also been aware of the scams since January. A statement on the company’s official website says that scammers have been contacting registry customers in order to demand fees and personal information to renew business names. 

ASIC also recommends that users who are unsure of the email’s authenticity to forward the email to ReportASICEmailFraud@asic.gov.au, contact ASIC and report the emails to Scamwatch.

ASIC says the email are most likely scams if they ask users to make payments over the phone, make payments to receive a refund, and request credit card or bank details by email or phone.

ASIC will only issue business renewals 30 days before its renewal date. “You can search for your business name on our register and if it's outside our usual timeframe, it might be a scam.”

ASIC recommends that users:

  • Keep antivirus software up to date
  • Scrutinise emails that don’t use your name, misspell details and include unknown attachments
  • Don’t click links in suspicious emails
  • If funds or personal details have been provided, contact your bank or financial institution immediately.
GitHub launches fund to sponsor open source developers
In addition to GitHub Sponsors, GitHub is launching the GitHub Sponsors, GitHub will match all contributions up to $5,000 during a developer’s first year in GitHub Sponsors.
Check Point announces integration with Microsoft Azure
The integration of Check Point’s advanced policy enforcement capabilities with Microsoft AIP’s file classification and protection features enables enterprises to keep their business data and IP secure, irrespective of how it is shared. 
Why AI will be procurement’s greatest ally
"AI can help identify emerging suppliers, technologies and products in specific categories."
Are AI assistants teaching girls to be servants?
Have you ever interacted with a virtual assistant that has a female-based voice or look, and wondered whether there are implicitly harmful gender biases built into its code?
Google 'will do better' after G Suite passwords exposed since 2005
Fourteen years is a long time for sensitive information like usernames and passwords to be sitting ducks, unencrypted and at risk of theft and corruption.
Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
Data#3 to exclusively provide MS licences to WA Government
The technology services provider has won two contracts with the Western Australia Government, becoming its sole Microsoft licence provider.
Why cash is no longer king in Australia
Australia is leading the way in APAC for granting credit on B2B transactions.