We got hit with a variant of the Locky Virus yesterday. Two users - localized to just their PCs.
The one user calls me up. Starts the tirade about how our email server infected her computer. We also provide email for another organization and I was given the entire rant about how our server infected someone else's computer.
The email was simple.
It appeared to be sent from the user, to the same user -
"Did you send yourself an email?" - "No, but sometimes I do."
It had an attachment in .rar format (I block .zip as well as all executable attachments. We had a reason for using .rar files for a while and to be honest, I'd seen very little use of this format for moving viruses. Beyond that, our gateway AV scans into compressed files for viruses.)
"Did you send yourself an attachment?" - "No."
In the body of the email it says, "Sent from my...