On Thursday, Rackspace warned its customers about the increased risk of phishing attacks following a ransomware attack on its hosted Microsoft Exchange environment.
See also: Corporate email accounts are being sold for $2 on dark web marketplaces
As the company continues to analyze this incident and work to restore all affected systems, there is a possibility that hackers could exploit the situation and use it as an opportunity for their own benefit.
Rackspace added that customers could easily spot scammers trying to steal their sensitive information by:
- Emails from Rackspace will be sent from the @rackspace.com email address (although attackers may still use a spoofed email and redirect their targets to a phishing landing page)
- Rackspace support does not ask for login credentials or personal information during phone calls.
As the company has not yet stated whether the attackers obtained any data through the breach, customers are advised to remain vigilant and check their credit reports and bank account for any unknown activity.
See also: APT37 group uses an Internet Explorer zero-day and spreads malware
Following the ransomware incident, some customers reported an increasing number of phishing emails falsely claiming to be from Rackspace.
Those affected by the ransomware attack on Rackspace should not open suspicious email attachments or click on suspicious links.
So far we don't know who carried out the attack
Despite Rackspace confirming that the cause of the outage of its hosted Microsoft Exchange was a ransomware attack, it has not released any information about the identity of the attackers. It is also not known at this time whether customer data was accessed
However, the homeland security team revealed that their investigation is still in its early stages.
See also: Royal ransomware: Attacks healthcare organizations
The company assured its customers that it would notify them immediately if any evidence emerged that threat actors had gained access to their data.
Information source: bleepingcomputer.com
