The €214,50 Attachment on the Station Mailbox

1. Double extension .pdf.exe - Windows often hides known extensions, so the file displays as a PDF. It is an executable. The attacker wants a click, not a reading.
2. Look-alike sender domain gov-cy.info - the official space is gov.cy; adding a hyphen and switching the top-level domain is cheap and looks convincing at a glance on a phone.
3. Artificial urgency and legal threat - "within 24 hours" and "court action" are designed to bypass the recipient's judgement and produce an immediate click.
4. A precise, plausible amount (214,50 €) - pseudo-specificity mimics genuine notices and discourages the recipient from checking.
5. Instruction to "enable editing" or "enable content" - this is the payload delivery step; enabling macros can execute code that downloads further malware.
6. Unsolicited attachment with no case reference - a genuine force would not serve a notice as an executable attachment, and there is no reference to an incident the recipient recognises.
7. Generic greeting and mixed language/formatting errors - bulk phishing cannot personalise, and the odd punctuation of the amount is a mass-mailing artefact.

1. Do not open the attachment, do not forward the email, do not reply. Do not "test" it on another machine.
2. Preserve the evidence: note the sender address, full headers, subject and time received, and take a screenshot before anything is deleted. Report per the station's incident procedure to the supervisor and to IT / the incident response contact.
3. Contain the colleague's computer. Unplug the network cable and disable Wi-Fi so it cannot reach the records system or the shared printer. Do not power it off - volatile evidence such as running processes and network connections is lost, and some malware is triggered at shutdown. Do not run a cleaner or antivirus "to help".
4. Do not insert the USB stick. An unknown device found in a car park can be a keystroke logger or an infected drive that autoruns. Bag it, record where and when it was found and by whom, and hand it to IT for examination.
5. Protect credentials: if the colleague logged into the records system from that machine, have her change her password from a different, clean device, and ask IT to review her account activity and check for lateral movement.
6. Write the incident note: times, names, what was clicked, what was disconnected, who was informed. If personal data may be exposed, escalate to the data protection officer.

Why the click is the decisive event

The unopened email is a delivery attempt that failed. Clicking "Enable Content" authorises a macro to run, and a macro runs with the user's own permissions on that machine. That gives an attacker a foothold inside the network perimeter: the ability to install tooling, capture keystrokes and credentials, map the network and move laterally towards the records system. The reported slowness is consistent with a background process. The email is the envelope; the macro is the intruder.

Changes afterwards

• Technical controls: block macro execution from internet-originated files by policy, block executables at the mail gateway, filter look-alike domains, enforce multi-factor authentication on records access, and apply least privilege so a workstation is not a gateway to the whole system.
• Device policy: ban personal and unknown USB devices, disable autorun, and issue only encrypted, registered media.
• Human layer: short, regular awareness briefings that do not shame the person who clicked - the value of a report depends on people reporting quickly. Keep a one-page "what to do in the first five minutes" card by each terminal.
• Process: a named contact and out-of-hours route for IT incidents, a written incident log, and a lessons-learned review circulated to all shifts.