Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/11/2019
12:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

281 Arrested in International BEC Takedown

Conspirators stole more than 250,000 identities and filed more than 10,000 fraudulent tax returns, the Department of Justice reports.

A coordinated law enforcement operation targeting business email compromise (BEC) has led to the arrest of 281 individuals around the world, including 74 in the United States, 167 in Nigeria, 18 in Turkey, and 15 in Ghana, the Department of Justice reported this week. Alleged fraudsters were also arrested in France, Italy, Japan, Kenya, Malaysia, and the United Kingdom.

BEC scams are sophisticated schemes typically designed to target employees with access to company finances or organizations that work with suppliers and regularly send wire transfers. The same people who drive BEC fraud also target individuals, such as real estate purchasers or the elderly, convincing them to send money to criminal-owned accounts by impersonating a key employee, breaking into a target's email account, or launching a romance or lottery scam.

Many BEC scams are perpetrated by foreign nationals who are often members of transnational criminal organizations that originated in Nigeria and spread throughout the world. The DoJ has ramped up efforts to take down those targeting American citizens and businesses with BEC.

Operation reWired was a four-month effort by the US DoJ, Department of Homeland Security, Department of the Treasury, Postal Inspection Service, and Department of State. The operation resulted in the seizure of nearly $3.7 million, the DoJ reported this week. Law enforcement worked with domestic and international groups to complete this operation.

Starting in May 2019, officials went after hundreds of BEC scammers and executed over 214 domestic actions including arrests, money-mule warning letters, and asset seizures and repatriations amounting to nearly $3.7 million; however, it seems scammers were after greater monetary gain.

In addition to corporate and individual finances, fraudsters may target personally identifiable information (PII) or employee tax records so they can file fake returns or sell stolen data online. Such was the case here: In investigating this massive identity theft and tax fraud scheme, law enforcement discovered conspirators stole more than 250,000 identities and filed more than 10,000 fraudulent tax returns, attempting to generate more than $91 million in refunds.

"The investigation of these crimes crossed international borders," said director Todd Brown of the US Department of State's Diplomatic Security Service. "Today's charges are another successful example of our commitment to working together with both foreign colleagues abroad as well as local, state, and federal law enforcement partners here at home in the pursuit of those who commit cyber-related financial crimes."

Many of the cases targeted by Operation reWired involved international criminal organizations that reportedly defrauded businesses large and small; others allegedly targeted individual victims who transferred high volumes of money or sensitive data. BEC is a tremendous financial burden to the companies and people it affects, the FBI reports, and reported losses are growing.

In a disclosure published the same day as the Operation reWired announcement, the FBI reported a 100% increase in identified global exposed losses related to BEC between May 2018 and July 2019. Between June 2016 and July 2019, there were 166,349 domestic and international cases of BEC; these generated $26.2 billion in total exposed monetary losses.

This increase in the number of incidents is partly attributed to greater awareness and reporting of BEC scams, which have been reported in all 50 states and 177 countries. Fraudulent transfers have been sent to at least 140 countries, though most go to banks in China and Hong Kong. Still, the FBI points to an uptick in fraudulent transfers sent to the UK, Mexico, and Turkey. 

The FBI's Internet Crime Complaint Center has seen an increase in the number of BEC complaints related to the diversion of payroll funds, indicating human resources or payroll departments are receiving spoofed emails asking for a change in direct deposit accounts.

Some businesses say they have received phishing emails prior to requests for direct deposit changes. Employees may receive similar emails with a fake login page for the email host, which captures their login credentials and gives attackers a way to access their personal information. With a legitimate username and password, a scammer can make a request appear legitimate.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Security Pros' Painless Guide to Machine Intelligence, AI, ML & DL."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24847
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
CVE-2020-24848
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
CVE-2020-5990
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
CVE-2020-25483
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVE-2020-5977
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.