Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

10/13/2020
02:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

25% of BEC Cybercriminals Based in the US

While the US is known to be a prime target for BEC attacks, just how many perpetrators are based there came as a surprise to researchers.

A new analysis of business email compromise (BEC) attacks reveals the global footprint of BEC activity: Twenty-five percent of perpetrators behind these threats are located in the United States. Of these attackers, nearly half are based in five states: California, Georgia, Florida, Texas, and New York.

The Agari Cyber Intelligence Division (ACID) today published the results of a study to better understand the operations of BEC attacks – in particular, the location of attackers and the money mules responsible for laundering their proceeds. While Nigeria has been a hot spot for social engineering scams, researchers found only half of attacks came from the West African country.

Related Content:

Scale Up Threat Hunting to Skill Up Analysts

2020 State of Cybersecurity Operations and Incident Response

New on The Edge: What Is End-to-End Encryption?

Their report contains information from more than 9,000 defense engagements between May 2019 and July 2020. In more than 2,200 of these, researchers could identify the attackers' likely locations. These do not include incidents in which attackers were likely using a proxy or other technique to anonymize their locations.

Based on these engagements, researchers identified BEC attackers in more than 50 different countries. Sixty percent of the attackers were based in 11 African countries; of these, 83% were based in Nigeria. South Africa was home to 14% of Africa-based attackers and the third-largest base for BEC groups worldwide. This was the only country in the study to see a decline in BEC attackers during the study. Eleven percent of global BEC actors were in South Africa during the last eight months of 2019, but this number dropped to 6% in the first seven months of this year.

Nearly 30% of global attackers were based in the Americas. Of these, 89% call the US home. While the US is known to be a prime target for BEC attacks, researchers were surprised to learn many perpetrators are based there. They also noticed clusters of attackers around a few metro areas including Atlanta, New York, Los Angeles, Houston, and Miami.

"The part about the US took us by surprise," says Crane Hassold, senior director of threat research at Agari. After removing instances in which attackers were using proxies and other anonymization sources, researchers assumed the percentage of US-based attacks would drop.

A closer look at the top US metro areas for BEC activity reveals a correlation with major arrests that have happened over the past couple of years, Hassold continues. One of these was Operation reWired, a law enforcement operation targeting BEC that led to the arrest of 281 people worldwide, including 74 in the US, 167 in Nigeria, 18 in Turkey, and 15 in Ghana.

"Geolocation is one of the many data points that defense is taking on when they're thinking of where threats come from," he explains. "One of the big things to keep in mind here is that location data may not be as helpful in some cases."

If security teams are only watching for attacks that originate in Nigeria, for example, they'll only see half of all BEC attacks that occur.

Tracking Illicit Funds: A Look at BEC Money Mules
Money mules were spotted all around the world: Over the course of the 15-month study, the team collected 2,900 mule accounts in 39 countries. Through these accounts, scammers intended to receive more than $64 million in stolen funds from BEC victims, researchers report.

Learning where money mules are located, and whether they're witting or unwitting in BEC operations, was a significant part of the research, Hassold says.

"The money mules are essentially the piece of the machine that makes this entire attack go, and without the mules, the entire ecosystem would fall apart," he explains. "Really understanding where they are, especially in the US, I found very fascinating because they're essentially the first stop for the money when it comes down to the business."

BEC attackers typically use a mule in the country where the target is based. This is unsurprising – Hassold says most mules were based in the US to start with – but may be partly due to restrictions that prohibit large international transfers. If an attacker sends a $30,000 payment to someone in the same country, it may not raise as many red flags as an international transfer. International transfers are typically disguised as corporate account payments, he notes. 

Researchers identified more than 900 US-based money mules used in BEC scams between May 2019 and July 2020. At least one mule was spotted in every state, as well as the District of Columbia. Many of these are people who fall for romance scams or work-from-home scams, in which victims apply for and accept a job that could include receiving and reshipping goods, receiving "payments" from clients, or printing and sending checks – all part of a BEC operation.

While most mule accounts were at US-based banks, payments requested for those accounts were much lower than in other countries. For example, the average payment requested by BEC scammers for US-based accounts was $39,500. Payments requested for Hong Kong-based mule accounts averaged $257,300.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29458
PUBLISHED: 2020-12-02
Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.
CVE-2020-29456
PUBLISHED: 2020-12-02
Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in ...
CVE-2020-5423
PUBLISHED: 2020-12-02
CAPI (Cloud Controller) versions prior to 1.101.0 are vulnerable to a denial-of-service attack in which an unauthenticated malicious attacker can send specially-crafted YAML files to certain endpoints, causing the YAML parser to consume excessive CPU and RAM.
CVE-2020-29454
PUBLISHED: 2020-12-02
Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
CVE-2020-7199
PUBLISHED: 2020-12-02
A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access,...