Vulnerabilities / Threats

1/18/2018
04:10 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

BEC Attacks to Exceed $9B in 2018: Trend Micro

Business email compromise is projected to skyrocket as attackers adopt sophisticated techniques to dupe their victims.

Business email compromise (BEC) attacks are projected to exceed $9 billion in 2018. To put that number in context, it has been less than a year since the FBI reported BEC attacks had become a $5.3 billion industry. Attacks have become more sophisticated as hackers improve their game.

BEC has grown among threat actors due to "its relative simplicity," according to a new Trend Micro report "Tracking Trends in Business Email Compromise (BEC) Schemes." Researchers analyzed BEC as a cybercriminal operation from January through September 2017, dissecting tools and strategies commonly used in these attacks to predict activity for this year.

"This particular type of attack is not going away -- it's only increasing," says Ed Cabrera, chief cybersecurity officer at Trend Micro.

The Internet Crime Complaint Center (IC3) puts BEC attacks in five categories: Bogus Invoice Schemes, CEO Fraud, Account Compromise, Attorney Impersonation, and Data Theft. In this case, researchers split them in two: Credential-grabbing and Email-only. Attackers must be proficient in at least one of these methods for the scheme to work, researchers report.

Method 1: Snatching credentials

This tactic leverages keyloggers and phishing kits to steal credentials and access an organizations email. Researchers noticed an uptick in phishing HTML pages sent as spam attachments which, while not new, is still effective against unsuspecting users.

Phishing is one of the primary methods used to steal email login data for BEC attacks. Once an attacker compromises a Gmail account, for example, they can impersonate its owner or use personal information or credentials they find in the account.

The other credential-grabbing technique uses malware, which continues to be a problem for targets using antivirus tools because some attackers use crypter services to evade AV detection. Researchers note BEC actors are more frequently using phishing attacks over keyloggers because they're simpler and cheaper; actors don't need to shell out for builders and crypters.

Keyloggers and remote access tools (RATs) are the most common types of malware used for BEC because they're effective and inexpensive. Unlike attacks that rely on phishing to steal a single set of credentials, malware can collect all stored credentials on an infected machine.

Ardamax is one example of a keylogger found in recent BEC attacks. It's cheap (under $50), can send stolen data via SMPT or FTP, has webcam and microphone recording, and an option to export encrypted logs that users can browse in its log viewer. Lokibot, password stealer and coin wallet stealer, is another commonly used malware. A new version of Lokibot was found in 2017 with new features like the ability to capture screenshots on the target machine.

Method 2: Targeting inboxes

Email-only BEC attacks, which rely on social engineering, are getting more sophisticated as attackers get smarter. This tactic involves sending an email to someone in the target company's finance department, requesting an exec to transfer money as payment or as a personal favor. Usually, a spoofed email from the CEO is sent to the head of finance.

"The CFO has the authority and ability to request last-minute money transfers within the organizations," says Cabrera. "[Attackers] are trying to capitalize on the relationship between the CEO and CFO."

Cybercriminals launching BEC attacks carefully research their victims. "It's usually the advanced groups, but it's also almost akin to cyberespionage," he continues. "They have a healthy knowledge of who they're targeting, and who in the organization they're going to target."

This research is what makes them successful. Attackers want to know about the organization and its executives: who's on vacation, typical work hours, business travel. They want to know news surrounding the business and operations such as M&A activity and corporate events. Oftentimes actors target ADP credentials and payment/benefits information so they can better understand the employees they're targeting. All of this data, both public and private, leads to success.

"We're seeing a shift: 'How do we compromise email infrastructure and dig even deeper?'" Cabrera notes.

Social engineering scams can be tough to spot. Sometimes the subject line will give an attacker away; based on analysis of BEC email samples, more than two-thirds had subjects containing terms "request," "payment," or "urgent." Many said "wire transfer request" and "wire request."

In the "Reply To" line, many attackers add their email addresses so they can view replies from target recipients. Most email clients don't show the reply-to addresses, so they get away with it. If they don't do this, they create a legitimate-looking email address to impersonate a corporate executive. These usually involve free webmail services like "accountant.com" and "workmail.com."

"From a user side, awareness and training is critical," says Cabrera. "From the boardroom down to the server room, make sure [employees] know this is actually happening." He also advises taking a close look at gateway tools, what they're deploying, and how they can protect email.

"You need to understand the gateway is a critical line of defense and we need to be able to defend it," he adds.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/20/2018 | 3:38:54 PM
With emails, our prime assumption is that emails come from people.
Social-engineering email attacks have links to classic magic show acts - the performer uses our assumptions and expectations, developed through experience, to get us to see what's not there, or not notice what is. 

With emails, our prime assumption is that emails come from people, rather than from the programmed execution of code residing in a number of machines.  Next is the assumption that the name in the "From:" header is that of the "person" or entity sending the email.  Then we have the primal assumption that an email is an object, sealed by the sender, traveling directly from sender to recipient, its contents unobserved or altered. 

It's not surprising that so many carry forward the assumptions from a traditional mail, metaphor.  Many others know these technologies of digital networks, and social-engineering, well enough to exploit the vulnerabilities in the mechanisms and those who rely on them.  Conscience brings some of these to help; lack of conscience brings others to a smorgasbord of opportunities to exploit our misconceptions about email. 
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Data Privacy Careers Are Helping to Close the IT Gender Gap
Dana Simberkoff, Chief Compliance and Risk Management Officer, AvePoint, Inc,  8/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15601
PUBLISHED: 2018-08-21
apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.
CVE-2018-15603
PUBLISHED: 2018-08-21
An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the Author field of the "Leave a Comment" screen.
CVE-2018-15598
PUBLISHED: 2018-08-21
Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.
CVE-2018-15599
PUBLISHED: 2018-08-21
The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.
CVE-2018-0501
PUBLISHED: 2018-08-21
The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.