BEC Scam Hits Hundreds of Countries Singling Out Specific Industries

Over 500 organizations in over 50 countries have been targeted with a large-scale business email compromise (BEC) scam recently. That’s according to Russian cybersecurity and anti-malware company, Kaspersky Lab. The sectors that are in the shark’s eye this time are large industrial organizations such as those in the power, energy, and metals industries. The attacks start with spearphishing using very specially crafted and detailed email messages to targeted individuals.

Often, although not always, spearphishing victims are those in areas of an organization that deal with very sensitive information, such as finance and human resources. Spearphishing is when the attackers go to the effort to pinpoint specific information about the targets so they can write these detailed messages to them. For example, if a criminal is after information on W-2s or the W-2s themselves, they might find out who works in the human resources department at a given organization and has access to these. BEC is the term applied to email spearphishing attacks like those targeting these specific people, departments, industries, or even organizations. Often the email message will appear as if it is from a manager or executive within the company. In some cases, the sender may appear to be a board member. However, these addresses are often spoofed, or just made to look like they are from those people. Another term that the FBI has recently started using to describe these is email account compromise (EAC).

In these recent cases, the email message may look like an invoice, a purchase order, or a wire transfer request sent on behalf of companies with which the targets do business. Often these are suppliers or delivery services such as FedEx. The email tries to provide a sense of urgency that the victim must verify or confirm the information as soon as possible.

All the email messages that researchers saw either had attachments that exploited a vulnerability from way back in 2015 in Microsoft Office, were malicious files inside some type of archive file, or documents with macros or embedded objects. When activated, these downloaded programs to the computer that allowed the attackers to perform some type of activity such as spy on the user, take screen shots of activity, or send email messages from the compromised system.

Patching systems is very important to prevent vulnerabilities from being exploited. As soon as one is released, or as soon as a product no longer has support from the developer or manufacturer, it’s time to update. In addition, macros should be disabled in all programs by default. Most of the time, if a macro is needed, the user will know in advance to expect it and can enable those on an as needed basis.

As always, don’t click attachments or links in email messages from unknown senders or if those items are not expected.

Cybercrime using this method have been particularly successful of late in Nigeria. In that country, the criminals have managed to access information on projects and contracts, as well as on operations and main assets of the organizations being targeted.