BEC Attacks to Exceed $9B in 2018: Trend Micro

Business email compromise is projected to skyrocket as attackers adopt sophisticated techniques to dupe their victims.

Business email compromise (BEC) attacks are projected to exceed $9 billion in 2018. To put that number in context, it has been less than a year since the FBI
reported
BEC attacks had become a $5.3 billion industry. Attacks have become more sophisticated as hackers improve their game.
BEC has grown among threat actors due to its relative simplicity, according to a new Trend Micro report Tracking Trends in Business Email Compromise (BEC) Schemes. Researchers analyzed BEC as a cybercriminal operation from January through September 2017, dissecting tools and strategies commonly used in these attacks to predict activity for this year.
This particular type of attack is not going away -- its only increasing, says Ed Cabrera, chief cybersecurity officer at Trend Micro.
The Internet Crime Complaint Center (IC3) puts BEC attacks in five categories: Bogus Invoice Schemes, CEO Fraud, Account Compromise, Attorney Impersonation, and Data Theft. In this case, researchers split them in two: Credential-grabbing and Email-only. Attackers must be proficient in at least one of these methods for the scheme to work, researchers report.
Method 1: Snatching credentials
This tactic leverages keyloggers and phishing kits to steal credentials and access an organizations email. Researchers noticed an uptick in phishing HTML pages sent as spam attachments which, while not new, is still effective against unsuspecting users.
Phishing is one of the primary methods used to steal email login data for BEC attacks. Once an attacker compromises a Gmail account, for example, they can impersonate its owner or use personal information or credentials they find in the account.
The other credential-grabbing technique uses malware, which continues to be a problem for targets using antivirus tools because some attackers use crypter services to evade AV detection.
Researchers note
BEC actors are more frequently using phishing attacks over keyloggers because theyre simpler and cheaper; actors dont need to shell out for builders and crypters.
Keyloggers and remote access tools (RATs) are the most common types of malware used for BEC because theyre effective and inexpensive. Unlike attacks that rely on phishing to steal a single set of credentials, malware can collect all stored credentials on an infected machine.
Ardamax is one example of a keylogger found in recent BEC attacks. Its cheap (under $50), can send stolen data via SMPT or FTP, has webcam and microphone recording, and an option to export encrypted logs that users can browse in its log viewer. Lokibot, password stealer and coin wallet stealer, is another commonly used malware. A new version of Lokibot was found in 2017 with new features like the ability to capture screenshots on the target machine.
Method 2: Targeting inboxes
Email-only BEC attacks, which rely on social engineering, are getting more sophisticated as attackers get smarter. This tactic involves sending an email to someone in the target companys finance department, requesting an exec to transfer money as payment or as a personal favor. Usually, a spoofed email from the CEO is sent to the head of finance.
The CFO has the authority and ability to request last-minute money transfers within the organizations, says Cabrera. [Attackers] are trying to capitalize on the relationship between the CEO and CFO.
Cybercriminals launching BEC attacks carefully research their victims. Its usually the advanced groups, but its also almost akin to cyberespionage, he continues. They have a healthy knowledge of who theyre targeting, and who in the organization theyre going to target.
This research is what makes them successful. Attackers want to know about the organization and its executives: whos on vacation, typical work hours, business travel. They want to know news surrounding the business and operations such as M&A activity and corporate events. Oftentimes actors target ADP credentials and payment/benefits information so they can better understand the employees theyre targeting. All of this data, both public and private, leads to success.
Were seeing a shift: How do we compromise email infrastructure and dig even deeper? Cabrera notes.
Social engineering scams can be tough to spot. Sometimes the subject line will give an attacker away; based on analysis of BEC email samples, more than two-thirds had subjects containing terms request, payment, or urgent. Many said wire transfer request and wire request.
In the Reply To line, many attackers add their email addresses so they can view replies from target recipients. Most email clients dont show the reply-to addresses, so they get away with it. If they dont do this, they create a legitimate-looking email address to impersonate a corporate executive. These usually involve free webmail services like accountant.com and workmail.com.
From a user side, awareness and training is critical, says Cabrera. From the boardroom down to the server room, make sure [employees] know this is actually happening. He also advises taking a close look at gateway tools, what theyre deploying, and how they can protect email.
You need to understand the gateway is a critical line of defense and we need to be able to defend it, he adds.

Last News
▸ 27 Million South Koreans Hit by Online Gaming Theft. ◂ Discovered: 23/12/2024 Category: security	▸ Homeland Security Background Checks Breach Raises Concerns. ◂ Discovered: 23/12/2024 Category: security	▸ Fully committed to the future world of technology. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
BEC Attacks to Exceed $9B in 2018: Trend Micro