Dec. 19, 2008
Malicious Spear Phishing E-mails Caution Advisory - Malicious e-mails targeting “navy.mil” network users were detected on One-Net.
The e-mails have embedded links to a .zip file containing a malicious executable file, which is a variant of the “Poison Ivy Trojan.”
The e-mail is designed to make users believe that the attachment was removed by security filters, when in fact, there was no attachment.
The malicious content is only delivered if a user unwittingly follows the links in the body of the message.

Details of the malicious phishing e-mails are:
• Originators e-mail addresses: nmci.postmaster@navy.mil and postmaster@navy.mil.
• Subject: Nov 08 NNWC Directory.zip was removed.
• The e-mail directs users to click on one of the following links:
• https://webmail.exceptions. nmci.navy.mil/exchange/nov nwwc directory.zip.
• https://216.60.119.18/exchange/nov%2008%20nnwc%20directory.zip
or copy and paste a link placed in the e-mail into the address of a web browser.
• Once the user clicks or copies and pastes the embedded link, a variant of the Poison Ivy Trojan is downloaded to the users computer.
This is a phishing attempt and should be immediately deleted. Call One-Net at 243-3883 for more information.