theDocumentId => 1341060 How Attackers Weigh the Pros and Cons of BEC Techniques

Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

5/18/2021
05:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

How Attackers Weigh the Pros and Cons of BEC Techniques

Security researchers discuss attackers' evolving methodologies in business email compromise and phishing campaigns.

RSA CONFERENCE 2021 – Business email compromise (BEC) and phishing attacks make up a big chunk of security issues plaguing today's organizations, and they continue to prove a threat as attackers find new ways to blend into victims' inboxes and manipulate them into sending funds.

In its "2020 Internet Crime Report," the FBI Internet Crime Complaint Center (IC3) found Internet crime led to reported losses exceeding $4.2 billion. Of the 791,790 complaints received in 2020, 19,369 involved BEC and email account compromise (EAC) and caused $1.8 billion in losses.

"As the fraudsters have become more sophisticated, the BEC/EAC scheme has evolved in kind," officials wrote in their report. 

In 2013, attackers often began these campaigns by breaching the email accounts of chief executive officers or chief financial officers and sending emails to request wire payments that were sent to fraudulent locations. Now BEC/EAC attackers breach personal email accounts, compromise vendor emails, request W-2 forms, and ask for gift cards.

The wire transfer is "an evolving staple" of BEC, said Crane Hassold, senior director of threat research at Agari, in a talk at this week's virtual RSA Conference discussing the various forms that BEC can take. Social engineering is "extremely effective," BEC often has a higher return-on-investment compared to other attacks, and most defenses focus on the more technical attacks.

Wire transfers have some notable pros for attackers: They can lead to much higher payouts, for one, and they lend themselves to more sophisticated pretexts designed to trick their victims.

As an example, Hassold described one BEC attack that appeared toward the end of 2020 in which the attacker used a capital call as pretext for requesting $42,080 from a target business. A capital call is a request made by a firm to receive money promised to it by an investor.

"We've seen these types of payments go upward of $1 million," Hassold said, noting that investment-themed BEC attacks can usually demand higher amounts without seeming unusual.

In another recent BEC attack, the attacker impersonated a CEO during an acquisition. They emailed a member of the finance team to contact another attacker impersonating a legitimate attorney. Following this "handoff," the target employee was asked to make sizable payments as part of the acquisition, which was ultimately intended to go to the attackers.

"These are the types of sophisticated pretexts we see becoming more and more prevalent in the wire transfer/BEC space," Hassold said. 

Scammers spend more of their time creating emails that look legitimate. In doing so, they have credibility to demand more money in wire transfers.

While the wire transfer technique has its benefits, it also comes with downsides. These attacks often have slower payouts and require transfers between money mules before funds get to the attackers. Most scammers don't receive the money directly, Hassold noted, so they need intermediaries in the same location as their targets.

Counting BEC Cashout Methods
Payroll diversion is another BEC technique undergoing evolution as attackers seek new ways to be effective. These attacks involve an email to human resources requesting an update to an employee's bank account used for direct deposit.

Here, an upside to attackers is delayed detection. Employees only get paid once every couple of weeks; if their direct deposit doesn't come in, it'll take some time before they realize something is wrong. Another benefit is the type of mule accounts they can use. Most accounts used in wire transfers are normal commercial checking accounts. In payroll diversion, researchers see more prepaid accounts being used to receive funds, which enables a faster laundering process.

These prepaid cards are a key factor driving BEC today, said Hassold, noting that apps like CashApp are also becoming integral to the BEC ecosystem because they are a primary way funds are moved out of the country.

"CashApp lets someone convert funds to cryptocurrency very quickly," he noted.

There are also downsides to this technique. Employee salaries are unknown to attackers, so they don't know the payout unless an attack is complete. They also have a more limited range of targets because they can only email someone on the company's HR team.

Payroll diversion has, in many cases, eclipsed wire transfer as a percentage of BEC attacks, Hassold said, but it has fluctuated as companies implement protections. This tactic declined in early 2020 due to a change in mule accounts attackers were using. A primary organization used to receive payroll diversion attacks through 2019 put mitigations in place that forced attackers to seek new ways to receive their funds.

The third most popular tactic for BEC is the gift card scam. More than half (57%) of all BEC attacks Agari saw in 2020 requested gift cards as a form of payment, he noted.

Unlike payroll diversion, gift card scams have a much larger pool of potential targets. 

"There's a much larger population of potential employees that can be targeted in these attacks compared to other kinds of BEC attacks," Hassold said of gift card scams. 

Another pro for attackers is they are nonreversible. Once they are received, they are quickly laundered.

But unlike wire transfers or payroll diversion, the payout is smaller. A successful gift card scam will net the attacker $1,000 to $1,500, Hassold said. They're also less convincing to employees, who may be unlikely to purchase gift cards, snap pictures, and send them to attackers. 

"It has the potential to raise a lot of red flags as you go along," Hassold noted.

What's Next for BEC?
Scammers continue to think ahead and develop stealthier forms of attack, Hassold said.

He pointed to vendor email compromise as an example. In these attacks, the criminal sends a phishing email with the goal of capturing a victim's credentials in a phishing website. With the credentials, they can log into a target inbox and forward themselves information about invoices, payments, and other financial details. With this, the attacker is equipped to send a fake invoice to the company, posing as a customer and requesting money they expect to pay.

"A lot of BEC attacks we see in the news today are going to be these vendor email compromise attacks," Hassold said.

Another upcoming tactic involves the aging report, or a financial report that lists outstanding payments due for a vendor or supplier. It contains data on payments overdue, points of contact for each customer, and other information. Some BEC attackers now request an aging report instead of a wire transfer because they can use it to send convincing payment requests.

"What the attackers will do is they'll use all this information to send an email to all the customers on this list to send payments for outstanding balances," Hassold explained. 

In January 2021, more than 10% of all BEC attacks were requesting an aging report, "so we can see this is becoming much more popular in the BEC sphere."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32686
PUBLISHED: 2021-07-23
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and ...
CVE-2021-32783
PUBLISHED: 2021-07-23
Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy rem...
CVE-2021-3169
PUBLISHED: 2021-07-23
An issue in Jumpserver 2.6.2 and below allows attackers to create a connection token through an API which does not have access control and use it to access sensitive assets.
CVE-2020-20741
PUBLISHED: 2021-07-23
Incorrect Access Control in Beckhoff Automation GmbH & Co. KG CX9020 with firmware version CX9020_CB3011_WEC7_HPS_v602_TC31_B4016.6 allows remote attackers to bypass authentication via the "CE Remote Display Tool" as it does not close the incoming connection on the Windows CE side if t...
CVE-2021-25808
PUBLISHED: 2021-07-23
A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file.