Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

End of Bibblio RCM includes -->
05:10 PM
Connect Directly

How Attackers Weigh the Pros and Cons of BEC Techniques

Security researchers discuss attackers' evolving methodologies in business email compromise and phishing campaigns.

RSA CONFERENCE 2021 – Business email compromise (BEC) and phishing attacks make up a big chunk of security issues plaguing today's organizations, and they continue to prove a threat as attackers find new ways to blend into victims' inboxes and manipulate them into sending funds.

In its "2020 Internet Crime Report," the FBI Internet Crime Complaint Center (IC3) found Internet crime led to reported losses exceeding $4.2 billion. Of the 791,790 complaints received in 2020, 19,369 involved BEC and email account compromise (EAC) and caused $1.8 billion in losses.

"As the fraudsters have become more sophisticated, the BEC/EAC scheme has evolved in kind," officials wrote in their report. 

In 2013, attackers often began these campaigns by breaching the email accounts of chief executive officers or chief financial officers and sending emails to request wire payments that were sent to fraudulent locations. Now BEC/EAC attackers breach personal email accounts, compromise vendor emails, request W-2 forms, and ask for gift cards.

The wire transfer is "an evolving staple" of BEC, said Crane Hassold, senior director of threat research at Agari, in a talk at this week's virtual RSA Conference discussing the various forms that BEC can take. Social engineering is "extremely effective," BEC often has a higher return-on-investment compared to other attacks, and most defenses focus on the more technical attacks.

Wire transfers have some notable pros for attackers: They can lead to much higher payouts, for one, and they lend themselves to more sophisticated pretexts designed to trick their victims.

As an example, Hassold described one BEC attack that appeared toward the end of 2020 in which the attacker used a capital call as pretext for requesting $42,080 from a target business. A capital call is a request made by a firm to receive money promised to it by an investor.

"We've seen these types of payments go upward of $1 million," Hassold said, noting that investment-themed BEC attacks can usually demand higher amounts without seeming unusual.

In another recent BEC attack, the attacker impersonated a CEO during an acquisition. They emailed a member of the finance team to contact another attacker impersonating a legitimate attorney. Following this "handoff," the target employee was asked to make sizable payments as part of the acquisition, which was ultimately intended to go to the attackers.

"These are the types of sophisticated pretexts we see becoming more and more prevalent in the wire transfer/BEC space," Hassold said. 

Scammers spend more of their time creating emails that look legitimate. In doing so, they have credibility to demand more money in wire transfers.

While the wire transfer technique has its benefits, it also comes with downsides. These attacks often have slower payouts and require transfers between money mules before funds get to the attackers. Most scammers don't receive the money directly, Hassold noted, so they need intermediaries in the same location as their targets.

Counting BEC Cashout Methods
Payroll diversion is another BEC technique undergoing evolution as attackers seek new ways to be effective. These attacks involve an email to human resources requesting an update to an employee's bank account used for direct deposit.

Here, an upside to attackers is delayed detection. Employees only get paid once every couple of weeks; if their direct deposit doesn't come in, it'll take some time before they realize something is wrong. Another benefit is the type of mule accounts they can use. Most accounts used in wire transfers are normal commercial checking accounts. In payroll diversion, researchers see more prepaid accounts being used to receive funds, which enables a faster laundering process.

These prepaid cards are a key factor driving BEC today, said Hassold, noting that apps like CashApp are also becoming integral to the BEC ecosystem because they are a primary way funds are moved out of the country.

"CashApp lets someone convert funds to cryptocurrency very quickly," he noted.

There are also downsides to this technique. Employee salaries are unknown to attackers, so they don't know the payout unless an attack is complete. They also have a more limited range of targets because they can only email someone on the company's HR team.

Payroll diversion has, in many cases, eclipsed wire transfer as a percentage of BEC attacks, Hassold said, but it has fluctuated as companies implement protections. This tactic declined in early 2020 due to a change in mule accounts attackers were using. A primary organization used to receive payroll diversion attacks through 2019 put mitigations in place that forced attackers to seek new ways to receive their funds.

The third most popular tactic for BEC is the gift card scam. More than half (57%) of all BEC attacks Agari saw in 2020 requested gift cards as a form of payment, he noted.

Unlike payroll diversion, gift card scams have a much larger pool of potential targets. 

"There's a much larger population of potential employees that can be targeted in these attacks compared to other kinds of BEC attacks," Hassold said of gift card scams. 

Another pro for attackers is they are nonreversible. Once they are received, they are quickly laundered.

But unlike wire transfers or payroll diversion, the payout is smaller. A successful gift card scam will net the attacker $1,000 to $1,500, Hassold said. They're also less convincing to employees, who may be unlikely to purchase gift cards, snap pictures, and send them to attackers. 

"It has the potential to raise a lot of red flags as you go along," Hassold noted.

What's Next for BEC?
Scammers continue to think ahead and develop stealthier forms of attack, Hassold said.

He pointed to vendor email compromise as an example. In these attacks, the criminal sends a phishing email with the goal of capturing a victim's credentials in a phishing website. With the credentials, they can log into a target inbox and forward themselves information about invoices, payments, and other financial details. With this, the attacker is equipped to send a fake invoice to the company, posing as a customer and requesting money they expect to pay.

"A lot of BEC attacks we see in the news today are going to be these vendor email compromise attacks," Hassold said.

Another upcoming tactic involves the aging report, or a financial report that lists outstanding payments due for a vendor or supplier. It contains data on payments overdue, points of contact for each customer, and other information. Some BEC attackers now request an aging report instead of a wire transfer because they can use it to send convincing payment requests.

"What the attackers will do is they'll use all this information to send an email to all the customers on this list to send payments for outstanding balances," Hassold explained. 

In January 2021, more than 10% of all BEC attacks were requesting an aging report, "so we can see this is becoming much more popular in the BEC sphere."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass authentication resulting in privilege escalation.
PUBLISHED: 2023-03-27
In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arbitrary code.
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Gateway service and bypass authorization, which could result in privilege escalation.
PUBLISHED: 2023-03-27
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect service, which could allow deserialization of requests prior to authentication, resulting in remote code execution.
PUBLISHED: 2023-03-27
Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.