I'm the Information Security Analyst at DeKalb Medical Center. The article isn't exactly right, it mixes up two different stories that my boss told the reporter.
"Pink Slip" email: A few employees received an email from "John.E" (John.T@chenpr.com) saying that they had insider knowledge that the email recipient would be getting fired soon. The email went on to say that there were some "folks who helped" his brother, and gave a phone number in Alabama that has been disconnected. The domain name belongs to a company in Massachusetts, so this may be a Joe Job on them or someone just forging their address to make their services look legit. Others have received this Spam, too.
"Keylogger" email: This was just a regular SPAM email, but was forged to be from a legitimate email address in our company. It had a link to an executable on a website in China, but was disguised using html to make it look like the link went to our domain. There was no keylogger in the payload of this trojan, only a SPAM virus that we quickly detected and removed. This email got through because it was forged from a specific email address that we allow to come from the internet with a forged "From" address.
Slashdot Mirror
I'm the Information Security Analyst at DeKalb Medical Center. The article isn't exactly right, it mixes up two different stories that my boss told the reporter.
"Pink Slip" email: A few employees received an email from "John.E" (John.T@chenpr.com) saying that they had insider knowledge that the email recipient would be getting fired soon. The email went on to say that there were some "folks who helped" his brother, and gave a phone number in Alabama that has been disconnected. The domain name belongs to a company in Massachusetts, so this may be a Joe Job on them or someone just forging their address to make their services look legit. Others have received this Spam, too.
"Keylogger" email: This was just a regular SPAM email, but was forged to be from a legitimate email address in our company. It had a link to an executable on a website in China, but was disguised using html to make it look like the link went to our domain. There was no keylogger in the payload of this trojan, only a SPAM virus that we quickly detected and removed. This email got through because it was forged from a specific email address that we allow to come from the internet with a forged "From" address.
Hope that helps clear things up.