We are seeing a fairly large Ursnif /Gozi /ISFB campaign hitting the UK since Yesterday. Earlier we saw a Brexit theme and now we are seeing emergency exit notices. The subject this time is consistent in all versions “Urgent to all residents of the building”. The name in the body of the email matches the alleged sender & is different in each version. These are coming from dozens ( or even hundreds) of different email addresses and IP addresses all from 1 hosting company using the IP range of 193.233.30.* This appears to be a server based in Russia, mgnhost.ru AS202423 PE … Continue reading →