Cloudflare warns that business email compromise (BEC) phishing has assumed a new form: vendor email compromise (VEC). The classic BEC case involves the impersonation of someone within an organization, taking advantage of the trust that builds up among co-workers to induce the victims to take some action–usually transfering funds, compromising credentials, or installing malware–that’s harmful to the organization.
VEC involves a similar abuse of trust. “Like business email compromise (BEC) attacks, VEC works by impersonating a trusted third party and sending a legitimate-sounding but malicious email to a target. While traditional BEC attacks usually claim to be from a trusted individual within the organization, VEC goes one step further: it impersonates vendors (or other trusted third parties) in order to trick the target into paying fraudulent invoices, disclosing sensitive data, or granting access to corporate networks and systems.”
One way of thinking about VEC, Cloudflare explains, is to regard it as a “financial supply chain compromise.” It tends to be more sophisticated than other forms of BEC if only because it requires some preparatory work and closer targeting of the victim. “VEC generally requires a greater understanding of existing business relationships — like ongoing project details, budget data, and financial transaction schedules. This research process may take weeks to months, but the potential payoff for the attacker is far greater than more generalized attack methods, as it can take a significantly longer time for the target to identify the attack and stop payments from going through.”
And once the VEC scammers have decided on their target, and once they’ve cultivated an appropriate level of trust through such displays of familiarity with that target, “they can carry out further malicious actions: requesting payment for fake invoices, tampering with billing account details, gathering sensitive information about the targeted organization, and so on.”
An important part of an effective defense against VEC is new-school security awareness training. Informed and properly skeptical personnel are far less likely to fall for the scam, and are far more likely to offer the scammers a target too tough to crack.
Cloudflare has the story.
CEO fraud has ruined the careers of many executives and loyal employees, causing over $26 billion in losses. Don’t be the next victim. This manual provides a thorough overview of how executives are compromised, how to prevent such an attack and what to do if you become a victim.
