Fake quotation requests: CERT Polska warns about XLS files delivering Remcos

On October 6, CERT Polska warned about fake requests for quotation. In the reported campaign, an email carries an .xls file that installs Remcos when run. The malware can enable remote device control and monitoring of user activity.

Breachroad recommends discussing this scenario with employees handling new customers, suppliers and shared inboxes today. Establish how to verify a request before working with its attachment and where to send the message for assessment. Employees need to know that route even when a potential order appears important and urgent.

A new business opportunity needs routine verification

Imagine a salesperson receiving a request for a quick quote. They do not know the sender, but the subject matches their company’s offering. In our illustrative scenario, they first assess whether the request makes business sense and whether the contact can be confirmed independently of the email. They decide how to handle the document after that assessment.

This is Breachroad’s proposal, rather than a reconstruction of a particular attack. An employee does not need to analyse a malicious file themselves. Their role is to recognise uncertainty and use the agreed support channel. IT should provide a response that lets them safely continue serving a legitimate customer.

We suggest checking the company name, sender address and consistency with earlier correspondence. Use contact details obtained from a trusted source or already held by the organisation to verify the request. Treat a phone number or signature in a suspicious email as part of the material that needs checking.

Agree on document-handling rules

Our proposal for sales and procurement managers is to define who assesses an unexpected attachment, how to send it for review and how long a response takes. Avoid leaving employees to choose between a risky action and losing a potential order. A useful procedure should account for the actual pace of customer service.

Teams should report unusual requests to perform extra actions on a document, change security settings or install a tool. Do not take those steps solely to follow instructions from an unverified sender. Assessment of a file’s format and origin belongs in the agreed process, rather than depend on what the email claims.

We do not describe every XLS spreadsheet as malicious. The practical conclusion from the warning is that a routine subject and a familiar extension are insufficient to establish safety. Rules should help employees assess the context and the next actions being requested of them, including when a message is forwarded internally by a colleague.

If the file has already been run

We recommend contacting workplace IT or the incident-response team promptly. Provide the time, message, filename and actions taken. Do not open the attachment again to demonstrate the problem to someone else, or forward it outside the channel specified by the response team.

Where infection is suspected, follow the device-isolation procedure. Avoid signing into more services from that device to investigate accounts independently. The person leading the response should assess access scope, evidence preservation and credential-related actions. These are Breachroad’s recommendations; receiving a suspicious email alone does not establish that a device is infected.

Suspicious correspondence can be reported through CERT Polska’s incident form. Connect that option with your organisation’s reporting channel so that administrators learn about the event and can assess other inboxes or devices. Employees should know which team coordinates any further reporting.

Practise the decision with employees

At a short briefing, present a synthetic quotation request and ask the team how they would confirm the sender, whom they would consult and what they would do after running the document. Check whether new employees and people covering a colleague’s role can understand the procedure. This does not require opening a real malicious attachment.

Our phishing awareness guide can help prepare the discussion. Through cybersecurity training for organisations, sales, procurement and administration teams can practise these decisions with examples relevant to their everyday work.