Alert! Government Issues Advisory on Fraudulent Prime Minister Office and SIFC Officials

Usama AnjumLast Updated: Oct 25, 2023

The Cabinet Division of the government of Pakistan has recently issued an advisory advising all ministries and departments to be careful against hacking attempts. The advisory was issued after it was found that some malicious actors were involved in sending fake emails and WhatsApp messages with attachments carrying malicious links. Furthermore, the advisory stated that malicious attachments containing “Notice 3rd EC meeting EC SIFC.rar” and “Apex Agenda.rar” from fake appointments of the PMO and SIFC cell, PM secretariat to various ministries, have been reported.

Moreover, mobile numbers and email IDs have been found that claim to belong to the SIFC Cell of the PMO and urge the officials of ministries to download files via web WhatsApp or fake emails. In this regard, NTISB has initiated an inquiry into the incident.

The cabinet division has asked the relevant authorities to stay careful while opening a password-protected.rar file containing references to the SIFC apex committee or any similar committee meetings. According to the cabinet division, these files should be accessed after getting approval from relevant departments.

Furthermore, it was advised that a RAR file, even without a password, including a.chm file and a.exe file or application file, shall also not be opened without the prior approval of NITB staff. In addition, all ministries and divisions must install antivirus on all of their respective systems being used for accessing emails. Ministries can also use an alternate PC with a user-friendly version for this purpose.

The advisory has instructed users to ignore messages received from the following officers, WhatsApp numbers, and email addresses and also block them

03554231407 – Mr. Javed (Deputy Director, SIFC, PM Secretariat).
03417413656 – Mr. Shahzad Ahmad (Assistant Director, PMO, SIFC cell).
03470300269 – email ID: [email protected].

Furthermore, as per the advisory, all of the ministries that opened emails on August 3, 2023, from JS COORD must also block the IP address: 151.236.30.248 for outbound communication in their firewall.