We got an official email saying that our website had been hacked. They cited the URL to use to see the new suspicious file that had been dropped in our web root folder (s.htm). Just some text about a "Morrocan Made hacker - I'm Back" in the HTML file. Nothing else seemed damaged although we are investigating.

The link included in the email was exactly hXXp://example.com[.]au/s.htm in plain text, which is also a bit weird, although helped us find the file.

The date stamp on the file is only 7 hours and 3 minutes different to the Sent date on the email. 7 hours could easily be a timezone deviation.

My question is: How did the government agency (CERT) know that our website was hacked? It's an Australian hosted website, for a legitimate business - and the government agency is legitimate.

It's extremely easy to fake email.  If someone did fake this, I don't see how the agency would know about it.  The concern is that the link they sent you was the attack itself.  For example, this could be a CSRF attack:


  With a little help of social engineering (such as sending a link via
  email or chat), an attacker may trick the users of a web application
  into executing actions of the attacker's choosing.


One suggestion is to contact the office and find out if this is something they do.  Just because the language seems right and says it's from the right sender means nothing.  That's a common approach used in phishing emails.
