NCERT Warns Against Email Phishing Attacks Targeting Govt Organizations

A recent advisory from the National Computer Emergency Response Team (NCERT) has revealed a sophisticated phishing email attack targeting government organizations.

The phishing campaign was aimed at compromising the credentials of government employees by deceiving them into clicking on malicious links or opening harmful attachments. Multiple public IP addresses were used to obscure the attackers’ identities, while cloud-based services added an extra layer of anonymity. The advisory provides detailed technical findings, including the tactics used by the attackers, and offers security measures to mitigate the threat.

The phishing emails were sent from compromised addresses and designed to trick recipients into visiting phishing websites aimed at stealing usernames and passwords. The attackers used cloud services, such as Cloudflare, to conceal the domain hosting these phishing sites, making it difficult to trace their real identity. Although the emails’ attached PDFs were free from embedded malicious files or scripts, they contained phishing links that relied on social engineering to deceive the recipients, rather than deploying malware to compromise systems.

The National CERT has issued several recommendations to protect against such phishing attacks. These include the implementation of advanced email filtering systems, the use of email authentication protocols such as SPF, DKIM, and DMARC, and the mandatory adoption of multi-factor authentication (MFA). Government organizations are also encouraged to reset the usernames and passwords of employees who may have interacted with these phishing emails to prevent unauthorized access to sensitive systems.

In addition to technical measures, the National CERT stresses the importance of raising awareness among government employees. Phishing awareness training, including simulated phishing exercises, is recommended to educate staff on identifying and reporting suspicious emails. Endpoint Detection and Response (EDR) systems should also be deployed to monitor unusual behavior and detect potential phishing-related malware, while all systems must be updated regularly to safeguard against emerging threats.

National CERT further advises on document security and network protection. Document handling policies should be enhanced to restrict unauthorized macros and scripts within files, and IP addresses linked to phishing attacks should be blocked at both organizational and national levels. Coordinated incident response plans and the sharing of threat intelligence across government bodies are key steps in ensuring the collective defense against these evolving cyber threats.