FBI Sends Private Industry Notification Warning of BEC Techniques

FBI-logo-webThe FBI sent out a Private Industry Notification (PIN) warning companies that attackers are abusing Microsoft Office 365 and Google’s G Suite to launch business email compromise (BEC) attacks, BleepingComputer reports. The criminals are using well-designed phishing kits to facilitate these attacks.

“The scams are initiated through specifically developed phish kits designed to mimic the cloud-based email services in order to compromise business email accounts and request or misdirect transfers of funds," the FBI said. “Between January 2014 and October 2019, the Internet Crime Complaint Center (IC3) received complaints totaling over $2.1 billion in actual losses from BEC scams targeting Microsoft Office 365 and Google G Suite.”

These attacks are far more sophisticated and targeted than other types of phishing attacks. The scammers sometimes lurk for months within the compromised account, observing the normal operations of the organization.

“Upon compromising victim email accounts, cybercriminals analyze the content to look for evidence of financial transactions,” the FBI said. “Using the information gathered from compromised accounts, cybercriminals impersonate email communications between compromised businesses and third parties, such as vendors or customers.”

Once the attackers have gained inside knowledge of the organization’s business operations, they’ll pose as employees of either the compromised organization itself or one of its partners and trick employees into sending payments to attacker-controlled bank accounts.

In addition, the attackers will steal the contact lists of the compromised email accounts. They can then target those contacts with spear phishing attacks and potentially gain a foothold within another organization.

These attacks are among the most difficult to spot from both a technical and a human perspective, because they appear to come from a trusted account belonging to a real employee within the organization. New-school security awareness training can create a culture of security within your organization that will enable your employees to verify the legitimacy of sensitive requests.

BleepingComputer has the story: https://www.bleepingcomputer.com/news/security/fbi-warns-of-bec-attacks-abusing-microsoft-office-365-google-g-suite/

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:


Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews