3

I have a curious problem.

I received a compromised email from an address on my university's domain. Not realizing it was faked, I clicked a link in the email to a url on my university's domain, and was then put through to an automatic download of a fake version of Flash. This exec file says it is made by Mandiant. I did some googling, and apparently there is a ransomeware attack that says it is a piece of Mandiant software. I promptly removed the files.

This all makes sense to me. The part that I don't understand is that now all of my family's devices (iPhones, android phones, pc and mac laptops) receive the same redirection/download when they hit any of my university's domains from any network (tested two different wifi networks and cellular connections so far).

How could this work? The university's system is clearly compromised to some degree. Could they have gotten all of the MAC addresses for devices on my network, and now be rerouting traffic based on this?

I should also note that a friend of mine has no issue accessing any of the university domains. He has had no exposure to my network.

closed as too broad by Eric G, schroeder Dec 30 '15 at 6:59

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • You are confused. Mandiant is a reputable cybersecurity company. – Neil Smithline Dec 28 '15 at 2:58
  • I've updated the post to reflect that the exe file claimed to be from Mandiant. Given the context of the download and the fact that it calls itself an Adobe Flashplayer update, I highly doubt that this is legit. Any input on what's going on here? – JwM Dec 28 '15 at 3:06
  • check on the devices which DNS they are using, and try to set it to 8.8.8.8 (google). if the problem goes away, the set you to a bad DNS. – Aganju Dec 28 '15 at 3:35
  • Interesting. I set my system to the google DNS and I still get redirected to the download page but now I receive a 404 Error page from my university saying that the requested page could not be found. Could the original redirect be in a bash file or something? – JwM Dec 28 '15 at 3:46
  • 1
    I think it would be appropriate to answer the question and accept your own answer. No point leaving it open if the problem has been solved. – Neil Smithline Dec 30 '15 at 5:42