APC (Schneider) phishing attempt?

[whiss33]

My boss received an email saying " Important Firmware Upgrade for your APC™ Smart-UPS™"

He forwarded it to me to make sure and update our APC UPS.

I went to Schneider/APCs website an downloaded and patched all the UPS devices.

After patching I noticed the latest version of the firmware was from 2021... so I thought "hmm.. if this was critical enough to email us (which I've never heard of Schneider doing before) then a newer firmware version should be available"

I go back to the email for details and see there is a link to download the security advisory. I hover over it and its some dendgrid.net link... clicking it opens a download dialog box for a file called "download.zip"

Oh no.

Let this be a reminder that the best thing to do when receiving email prompting you perform an update is to go directly to the vendors website and download it instead of clicking a link in email to get you there.Also, don't use an account with admin rights to add another layer of protection if you do manage to click something.

Good thing is, this forced us to actually get the updates done.