Insurance law firm Clyde & Co has warned that a new strain of the banking trojan malware called “Emotet” has “heavily impacted” the public and private health service industry in Australia – and may be spreading across the wider Asia-Pacific region and beyond.

The firm said that organizations will usually first become aware that they are impacted by the presence of malicious emails being sent to internal employees and external clients from an external sender, purporting to be the organization.

“The malicious email will usually contain an email trail of a previous conversation, with a document attached taking various forms (.doc, .docx, .pdf),” the firm said in its warning. “Once the document is opened, malware will propagate throughout the recipient’s network. In short: DO NOT OPEN ATTACHMENT.”

Since the Emotet malware spreads fast, Clyde & Co urged impacted organizations to act “very quickly.” Steps to addressing the problem include isolating affected machines from office networks, assessing the scope of the impact on your network including what information may be at risk, warning employees of the potential that they may receive malicious emails, and working with insurers to obtain assistance from expert vendors on response capabilities.

“Similarly to warning employees, notify all parties to all emails contained within affected mailboxes to remain vigilant to malicious emails and not to click on malicious links or attachments,” the firm said. “This needs to be done quickly but without causing undue alarm.”