Good afternoon, everyone.

It is hard to believe that we are getting close to the end of another year! But unfortunately, cybersecurity is always eventful no matter what time of year it is. Today I need to let you know about a very deceitful scam with perpetrators impersonating the Social Security Administration.

I also have a lot of important information to share with you to that you really need to know. UT is beginning a new phishing simulation program. In addition, I need to remind everyone to always make sure your apps and operating systems have not reached their end of support because it is a huge security risk. And finally, I want to make sure everyone who manages a server is fully aware of what may happen next month if they are not being managed according to standards and procedures.

Current Threats

• Social Security Administration (SSA) Emails
  • The sender is Social Security Administration <Information[@]update.ssa.gov>.
  • Subjects include Best Performance Ever in SSA’s 91-Year History and Giving America’s Children a Stake in the American Dream, but there may be others.
  • Links within the emails’ contents use “govlinks.ssa.gov” at the beginning of a long link, even for the Apple Store and Google Play.
  • The SSA never uses subdomains, such as “govlinks”, so if you see an email address using “@update.ssa.gov” or a website using an address like “govlinks.ssa.gov” you can absolutely know that this is not legitimate.
  • This is a trending scam with scammers often taking advantage of known information and programs, then using the fake links to trick users into providing sensitive information or downloading malware.
  • The SSA Office of the Inspector General has been issuing warnings about the fraudulent emails and websites that are impersonating the SSA.
  • Please take extra caution if you receive any email like this and do not click any links.
  • Use the red Report button in the upper left corner of your Outlook ribbon and choose “Report Phishing” because these truly are phishing attempts.

Important Information

• Phishing Simulations
  • Please be aware the UT is going to be doing phishing simulations systemwide in the very near future.
  • The plan is to send a phishing simulation email to every UT email address, including student and departmental email addresses, every two weeks and will be sent on varying days of that particular week.
  • The hope is to change that to random groups like UTK has done in the recent past but that won’t happen until early next year.
  • I have been told there are 85 different phishing simulation email templates and not everyone receives the same email nor on the same day.
  • The key here is to use the red Report button on the upper left corner of your Outlook ribbon and choose “Report Phishing” each and every time you get one of these emails.
  • OIT no longer wants anyone to forward to OIT Abuse because that is not monitored in the same way now, so the reporting, even for actual phishing emails will not be documented properly.
  • I know that a lot of people do not like getting phishing simulations, but they are used as a security awareness tool to help users recognize real attacks, build habitual awareness, and reduce real incident likelihood.
  • Please think of these as regular training sessions that take only a couple of minutes to complete and the email templates stay updated to align with current strategies used by the real scammers.
  • More information is expected to be sent by Matt Williams, the UTSA CISTO.

• Microsoft End of Support Dates
  • If you are running any of these apps, please make sure you upgrade them *before* the support comes to an end, but if you still have an end of support app or OS, please get it taken care of immediately.
  • Windows 10 – 10/14/2025 *see information below
  • Microsoft Publisher – 10/01/2026 (access ended for Microsoft 365 subscribers and Publisher is no longer available in any format)
  • Office LTSC 2021 – 10/13/2026 (Office LTSC 2019 reached the end of support last year!)
  • Windows Server 2012 / 2012 R2 – 10/13/2026 (this is the final year for paid Extended Security Updates)
  • Windows Server 2016 – 1/12/2027 (this is the final date for paid Extended Support)
  • If you are using anything listed here it MUST be updated.
  • UT wants you to use Microsoft 365 Apps for Enterprise instead of Office LTSC 2024 and 2026 so that you can take advantage of the special features that allow for more collaboration, better productivity, and consistency across the UT System.
  • As a reminder you can check for the version of Outlook you are using by clicking on File (top left), then Office Account (bottom left), then you should hopefully see “Microsoft 365 Apps for enterprise” on the right side.
  • If you do not see this, then look for “About Outlook” on the right side to see what the version is.
  • If you see that you need to be updated to Microsoft 365 Apps for Enterprise and you need help, please call the OIT HelpDesk at (865) 974-9900 and they will assign a ticket to the appropriate IT support group.
  • However, if you are with CVM, please contact CVM Computer Support, as they have their own ticketing system.
  • And please remember it is very important to always have the most up to date versions of all apps.
  • End of Support means:
    • No security patches;
    • No updates;
    • No technical help; and
    • No connections to Cloud services like Microsoft 365.

• Windows 10
  • Windows 10 officially reached end of support on 10/14/2025, but I see from Endpoint Central reports that we have several computers still running it.
  • This is definitely something we need to take care of right away.
  • If you have a computer running Windows 10, I will be contacting the appropriate support person(s) to see that it is taken care of.
  • Please note that if your IT support person(s) contacts you about a Windows 10 device, please work with them to see that it is upgraded to Windows 11 as soon as possible.
  • If the computer will not allow Windows 11 to be installed, that means the computer is old enough to be out of warranty and must be replaced.
  • Having a computer running an operating system that has not been updated in over a year is a major security risk!

• Server Reminder
  • Beginning 12/19/2026, UTK will disable any server they find on the network that has not been properly onboarded in Azure Arc, Tenable, and Defender.
  • In addition to servers being properly onboarded, they must by patched or a mitigation plan in place, or those servers will also be disabled.
  • This is to ensure all servers owned and operated by UTK, including UTIA, are being scanned by Tenable to ensure there are no critical vulnerabilities, and reports are shared weekly with the system administrators.
  • Servers are also being monitored by the UT/Dell Security Operations Center (SOC) 24×7 for Defender alerts showing any incidents or potential incidents so the sys admins can be contacted as soon as possible for remediation.
  • In This Week’s Cybersecurity News, 07/15/2026, I announced that I created and posted IT7801P – UTIA Vulnerability Management Procedure, which follows the UTSA policy for vulnerability management and also replaces the older UTIA IT0124P2 version.
  • System owners and system administrators (i.e., those responsible for maintaining servers) will be required to follow the appropriate timelines and remediation requirements in the UTIA procedures.
  • If you are unable to patch a server according to the timelines, you are required to submit a formal except request to me with details of compensating controls and mitigation plans.
  • Those responsible for maintaining UTIA servers are required to let me know if any server is added or removed.

Thank you so much to each of you for all you do! Any time you have a question, concern, or an issue, please do not hesitate to let me know!

Sandy

Important Note: Thank you so much for sharing these e-newsletters with family, friends, clients, students, and anyone else who may benefit from the information. I would like to stress that you should keep your students in mind, as non-employee students will not get this information without someone sharing. If anyone has an email group for students who are not employees of your department, please let me know what that address is, and I can include it. I do this as a blind copy so student names and addresses will not show up!