Cybercriminal Gang, Silent Starling, Creates New ‘Vendor Email Compromise’ Category

iStock-687977248New attacks focus on organizations with global supply chains looking to trick a supplier’s customers into paying fake invoices and have already impacted 500 organizations worldwide.

You’ve no doubt heard of Business Email Compromise (BEC), where an email is sent to someone within an organization seemingly from someone else in power in that very same organization in an attempt to commit fraud. You’ve also heard of island hopping, where attackers use a mix of compromised credentials, spoofed phishing emails, and malware to jump organizations.

Security vendor Agari has identified a new cybercriminal organization focused on one particular attack that sits so firmly in the middle of the previously mentioned two attack types that they felt the need to come up with a brand-new attack category – Vendor Email Compromise (VEC).

Similar to BEC, VEC targets supply chain customers by first compromising an organization, gaining access to its user credential, accounts payable application, and email platform; and then emails customers in an attempt to trick them into changing banking details on invoice payments so that funds will be routed to cybercriminal bank accounts instead of the supplier’s account.

Thus far, Agari has identified the following stats on this gang’s activities:

  • 500 companies in 14 countries affected
  • 20,000+ emails stolen since 2018
  • 39 employees compromised a just one U.S.-based company alone

There’s no details yet on the financial impact of such an attack, but given that BEC is estimated to cost over $4 Billion in 2019, it’s evident why Silent Starling wants to get into this business.

Organizations should educate both employees using Security Awareness Training of phishing attacks used to initially compromise online credentials and/or install malware onto endpoints. Vendors, customers, and contractors should also be encouraged to put their employees through the same training to be educated on BEC and VEC scams.

Will your users respond to phishing emails?

KnowBe4's Phishing Reply Test (PRT) is a complimentary IT security tool that makes it easy for you to check to see if key users in your organization will reply to a highly targeted phishing attack without clicking on a link. PRT will give you quick insights into how many users will take the bait so you can take action to train your users and better protect your organization from these fraudulent attacks!

PRT-imageHere's how it works:

  • Immediately start your test with your choice of three phishing email reply scenarios
  • Spoof a Sender’s name and email address your users know and trust
  • Phishes for user replies and returns the results to you within minutes
  • Get a PDF emailed to you within 24 hours with the percentage of users that replied

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews