CCR Data Center, Indianapolis, Indiana, March 21, 2023 1200 hrs

This is a CCR Technology Partners cybersecurity alert. CCR’s Security team has received reports of cybercriminals taking advantage of the recent collapse of Silicon Valley Bank (SVB) to run new phishing campaigns in attempts to phish or infect victims with malware.

Security Researchers are tracking a spike in newly registered domain names that reference SVB in some form and are expecting to see several email spoofing campaigns spring up, using such possible phishing email tactics as requesting changes to accounts, such as direct deposit.

One known campaign that is already active is one that is impersonating SVB using DocuSign notifications that are supposedly from SVB’s KYC Refresh Team. KYC is a banking term that stands for “Know Your Customer” or “Know Your Client” and is a mandatory process used by banks to verify account holder’s identities. If a user clicks on a link in the email, they will be taken to a spoofed Microsoft login page that is designed to steal login credentials.

Security researchers advise that any former SVB customers monitor their accounts to be aware of any payment changes and reach out to their contact over the phone instead of via email.

Additionally, CCR recommends that users do not reply to DocuSign emails that were sent from someone they don’t know. DocuSign also reports that links in legitimate emails will start with https:\\ and include docusign.net. Legitimate DocuSign emails will also include a unique 32-character security code that will allow users to directly access documents on https://docusign.com, and that DocuSign will never ask users to open PDF, Office documents, or ZIP files in an email. DocuSign also asks that users submit suspicious DocuSign emails to spam@docusign.com.

The CCR Technology Partners cybersecurity alert was created to keep you informed of possible threats to your corporate network environment.

Call the CCR Helpdesk at (317) 842-1754 if you need further information.