I have a curious problem.
I received a compromised email from an address on my university's domain. Not realizing it was faked, I clicked a link in the email to a url on my university's domain, and was then put through to an automatic download of a fake version of Flash. This exec file says it is made by Mandiant. I did some googling, and apparently there is a ransomeware attack that says it is a piece of Mandiant software. I promptly removed the files.
This all makes sense to me. The part that I don't understand is that now all of my family's devices (iPhones, android phones, pc and mac laptops) receive the same redirection/download when they hit any of my university's domains from any network (tested two different wifi networks and cellular connections so far).
How could this work? The university's system is clearly compromised to some degree. Could they have gotten all of the MAC addresses for devices on my network, and now be rerouting traffic based on this?
I should also note that a friend of mine has no issue accessing any of the university domains. He has had no exposure to my network.