The FBI sent out a Private Industry Notification (PIN) warning companies that attackers are abusing Microsoft Office 365 and Google’s G Suite to launch business email compromise (BEC) attacks, BleepingComputer reports. The criminals are using well-designed phishing kits to facilitate these attacks.
“The scams are initiated through specifically developed phish kits designed to mimic the cloud-based email services in order to compromise business email accounts and request or misdirect transfers of funds," the FBI said. “Between January 2014 and October 2019, the Internet Crime Complaint Center (IC3) received complaints totaling over $2.1 billion in actual losses from BEC scams targeting Microsoft Office 365 and Google G Suite.”
These attacks are far more sophisticated and targeted than other types of phishing attacks. The scammers sometimes lurk for months within the compromised account, observing the normal operations of the organization.
“Upon compromising victim email accounts, cybercriminals analyze the content to look for evidence of financial transactions,” the FBI said. “Using the information gathered from compromised accounts, cybercriminals impersonate email communications between compromised businesses and third parties, such as vendors or customers.”
Once the attackers have gained inside knowledge of the organization’s business operations, they’ll pose as employees of either the compromised organization itself or one of its partners and trick employees into sending payments to attacker-controlled bank accounts.
In addition, the attackers will steal the contact lists of the compromised email accounts. They can then target those contacts with spear phishing attacks and potentially gain a foothold within another organization.
These attacks are among the most difficult to spot from both a technical and a human perspective, because they appear to come from a trusted account belonging to a real employee within the organization. New-school security awareness training can create a culture of security within your organization that will enable your employees to verify the legitimacy of sensitive requests.
BleepingComputer has the story: https://www.bleepingcomputer.com/news/security/fbi-warns-of-bec-attacks-abusing-microsoft-office-365-google-g-suite/
Here's how it works:
