BEC Archives - Cyber Secure Forum | Forum Events Ltd
Posts Tagged :

BEC

Identify and investigate Business Email Compromise (BEC) scams

 960 640 Guest Post
By:
0
0

Business Email Compromise is an email-based phishing attack that specifically targets businesses and organizations to steal money, sensitive information, or account credentials. These attacks can be difficult to prevent as criminals may utilize social engineering techniques such as impersonation and intimidation to manipulate users.

Threat actors will often prepare for BEC attacks by first performing reconnaissance on their targets and uncovering publicly available data such as employee contact information to build a profile on the victim organization. Moreover, BEC attacks often focus on employees or executives who have access to more sensitive information or the authority to make payments on the organization’s behalf.

According to the FBI, there are five major types of BEC scams:

  • CEO Fraud: In this scenario, the attacker will pose as the company’s CEO or any executive and send emails to employees, directing them to send money or expose private company information.
  • Account Compromise: An employee’s email account has been compromised and is used to send BEC scams to other organizations and contacts from the compromised account.
  • Attorney/Tax Impersonation: The cyber-criminal will impersonate an attorney or other representatives from organizations like the IRS to scam employees. These attacks will attempt to pressure employees into acting quickly to avoid “official repercussions”.
  • Data Theft: Scammers may target employees in HR or those with access to employee information to obtain sensitive or private data regarding other employees and executives that can be used for future attacks.
  • False Invoice Scheme: The attacker will spoof an email from an organization or vendor that the victim works with. This email may contain an invoice requesting payment to a specific account that the attackers control.

What is the cost of Business Email Compromise (BEC) and how do you identify it? Carry on reading this blog post to learn more by clicking here or visit the Varonis website here.

Agari Report: New BEC scam 7X more costly than average, bigger phish start angling in

 960 640 Stuart O'Brien
By:
0
16

Sophisticated threat actors, evolving phishing tactics, and a $800,000 business email compromise (BEC) scam in the second half of 2020 all signal trouble ahead, according to analysis from the Agari Cyber Intelligence Division (ACID).

After attacks on Magellan Health, GoDaddy, and the SolarWinds “hack of the decade,” one thing is distressingly clear. Phishing, BEC, and other advanced email threats continue to be one of the most effective attack vectors into organisations. And it’s getting worse.

Throughout the second half of 2020, ACID uncovered a troubling rise in eastern European crime syndicates piloting inventive forms of BEC. Indeed, the state-sponsored operatives launching attacks from pirated accounts in the SolarWinds attack were just a few of the sophisticated threat actors moving into vendor email compromise and other forms of BEC.

But in November, a sudden surge in the amount of money targeted in BEC scams could be tracked back to the resurgence of one particular source—the threat group we’ve dubbed Cosmic Lynx.

After sewing chaos with COVID 19-themed scams earlier in the year, the group’s tactics shifted toward vaccine ruses. More alarmingly, the group’s emails also started requesting recipients’ phone numbers in order to redirect the conversation. It’s unclear if the request is designed to disarm recipients or if actual phone messages or conversations are now part of the con.

The second biggest driver behind the late-year increase in the amount sought in BEC scams is a potent new pretext—capital call investment payments. Capital calls are transactions that occur when an investment or insurance firm seeks a portion of money promised by an investor for a specific investment vehicle.

In emails to targets, BEC actors masquerade as a firm requesting funds to be transferred in accordance to an investment. Because of the nature of such transactions, the payments requested are significantly higher than the average $72,044 sought in wire transfer scams during 2020. The average payout targeted in these capital call cons: $809,000.

To learn more about the latest trends in phishing, BEC scams and advanced email threats and how to stop them, request information at https://www.handd.co.uk/agari-secure-email-cloud/.