First published: 03rd April 2014
Early on 1st April, emails with the subject "March Remit file - " followed by a 6-digit number were sent to Hong Kong-based email addresses. The emails appeared to be from the Hong Kong Monetary Authority, but in reality were sent from a variety of overseas IP addresses. The contents of the message encouraged the recipient to open the attachment:
Attached is the remit file for the last month (Remit_6310536.zip) received from your accountant.
Please print this label and fill in the requested information. Once you have filled out all the information on the form please send it to hkma_invoice@hkma.gov.hk .
For more details please see the attached file.
Please do not reply to this e-mail, it is an unmonitored mailbox!
Thank you ,
HONG KONG MONETARY AUTHORITY 55th Floor Two International Finance Centre 8 Finance Street Central Hong Kong
© 2014 Hong Kong Monetary Authority. All rights reserved.
*******************************************************************
This e-mail is confidential. It may also be legally privileged. If you are not the addressee you may not copy, forward, disclose
or use any part of it. If you have received this message in error, please delete it and all copies from your system and notify the
sender immediately by return e-mail. Internet communications cannot be guaranteed to be timely, secure, error or virus-free. The sender does not accept liability for any errors or omissions.
*******************************************************************
The attachment appeared to be a ZIP file, but is a trojan, variously identified as Troj/Agent-AGOJ, Trojan.GenericKD.1627845, or Trojan-Dropper.Win32.Injector.kbcs by Sophos, F-Secure and Kaspersky.
Similar malicious emails were sent out later the same day and on the morning of 3rd April.
The Monetary Authority has issued an alert about these fraudulent emails and the Police are investigating. Anyone who has received such emails should call Police at 2860 5012 or email crimeinformation@police.gov.hk.