ISLAMABAD: A cyber incident of sending fake WhatsApp messages and emails containing malicious attachments from fake appointments of the Prime Minister Office (PMO) and Special Investment Facilitation Council (SIFC) cell, Prime Minister Secretariat to various ministries has been reported.

Official documents of the National Telecommunication and Information Security Board (NTISB) Cabinet Division revealed that fake emails forwarded to ministries/divisions from email ID of Joint Secretary (Coordination).

The emails contained attachments Notice 3rd meeting EC SFIC.rar’ and "Apex_agenda.rar" from fake appointments.

Investigations pertaining to the said incident are under way at NTISB/N-CERT. In light of initial findings, following important information is shared with all the ministries for immediate attention:

Different phone numbers have been used by individuals claiming to be valid appointments of SIFC Cell the PM Secretariat for propagation of messages initially and then insisting the receiver to download file in their computers through WhatsApp web or emails. WhatsApp messages or emails from these numbers may be ignored and blocked.

Any email containing reference to the SIFC Apex Committee or any other committee meetings and containing a password protected.rar file; as attachment may be opened vigilantly or after approval/vetting from the sender or relevant department.

Any .rar file even without password containing a .chm file and an .exe file or application file shall not be opened without the approval of NITB staff.

Antivirus must be installed on all systems being used for opening of emails. As an alternate, Apple MAC may be used or PC may be installed with an appropriate user-friendly version.

All the ministries which opened email of 3rd August 2023 from JS COORD presssecretary@pmo.gov.pk must also block the IP address: 151.236.30.248 for out-bound communication in their firewall.

Copyright Business Recorder, 2023