Our IT dept. has a system like this, but if you report a legit email to it (as I’ve done twice in the last year) they don’t have the basic decency to tell you it’s fine. So I’ve had to find out later that I’d deprived myself of important access to systems that allow me to do my job.
If they can’t be arsed, then neither can I now. I just click on anything.
Do they attack libraries specifically? I would have thought they just fire off attacks all over the place and see what gets through. Libraries just happen to have poor defences I think.
I don’t know specifically for this attack, but many attacks are designed specifically to target an institution by say, cloning the webpage for an employee portal and stealing login credentials. Like I said, I don’t know what it was here, and I’m not an expert. But attacks have become more elaborate and specific as employees have generally become more savvy to them and don’t just click on anything that pops into their inbox anymore.
Or maybe just the result of scatter-shot attacks - fire away at thousands of IP addresses and then dive deep into whichever attacks happen to get in somewhere? I suspect a lot of these may just be collateral damage from indiscriminant attacks.