Cyberattack targets Polish municipalities, mayors in phishing campaign

Poland has issued a warning about an ongoing phishing campaign targeting municipalities nationwide. Cybercriminals are reportedly impersonating the Ministry of Digital Affairs to trick recipients into disclosing cybersecurity information or passing on malicious software.

Polish mayors and other officials, especially those responsible for cybersecurity, are receiving emails in which the sender impersonates Deputy Minister Paweł Olszewski.

The messages, which include pictures of Olszewski and the ministry’s logo, fall into two categories, according to CyberDefence24.

In one, senders target mayors and municipal leaders, asking them to verify employee personal data in an attached file. The cybercriminals lie that it’s an “enhanced security standard.”

CERT Polska, the country’s cybersecurity response team, warned that the file contains a link to malicious software.

The second type of email is an outreach to verify contacts under the National Cybersecurity Program. Recipients are asked to submit the contact information of staff responsible for cybersecurity within 48 hours.

The Ministry of Digital Affairs stated that it never requests confidential information such as passwords via email. Officials have been urged to ignore attachments or links in suspicious emails and verify the sender’s domain before responding.

So far, the giveaway is typical when it comes to phishing – emails come from addresses ending in .govministry instead of the official .gov. domain.

Cyberattacks on local governments and strategic facilities within their knowledge have become a regular target. Cybernews has previously reported on Russian hackers disrupting the work of a small hydropower plant in Poland.

In September, Poland increased its cybersecurity budget to €1 billion after a series of Russian hacks on hospitals.

As reported previously, the ongoing cyberattacks, 170,000 in total up until September this year, are seen as Russia’s response to Poland proactively supporting Ukraine in the ongoing war.

Unlock more exclusive Cybernews content on YouTube.