Spotlight on Business Email Compromise

Spotlight on Business Email Compromise

Business Email Compromise is a lucrative, and increasingly popular scam leveraged by attackers. This post details what these attacks are, the trends we see in attack techniques, and discusses recent research released on a sophisticated attacker group, dubbed Silent Staring.

Recommendations

• Never click links or open attachments in suspiscious email. If you receive an email suggesting that you direct payment to an account other than the one you generally deal with, confirm this with the organization - preferably not over email
• Consider enabling ZeroFOX email security rules to protect from scams such as this one
• Blacklist domains/URLs associated with this campaign. IOCs are included at the end of this report, and are also in the ZeroFOX ThreatFeed

Details

Business Email Compromise, or BEC, is on the rise. BEC is a type of scam that seeks to convince or blackmail employees into transferring funds into attacker-controlled accounts. This may seem like it would be an obvious scam - however, these kinds of attacks are often highly sophisticated. Generally, they leverage a sense of urgency, often combined with spoofing a person of authority as the sender of the email, to convince victims to meet their demands. One recent example of this is a BEC email scam we saw, that claimed the email sender had details regarding a plan to kidnap the recipient's children. The email sent in this case demanded that the recipient pay the sender, so that the sender would disclose details regarding the potential kidnapping.

Recent research has demonstrated an even higher level of sophistication in these kinds of scams, however. A report released today by the BEC team at Agari details how a Nigerian BEC team, Silent Starling, had managed to infiltrate over 500 organizations to tailor their scam campaigns to each organization. In short, the members of this group first sought to compromise employees at these organizations via phishing attacks. Then, after gaining access to email accounts within these organizations, the group monitored all communication regarding outgoing payments. Finally, the attackers interjected their own scam emails into these communication chains. Because the attackers had access to existing email communication regarding payments in and out of the compromised organization, they were able to tailor their scam emails to be extremely convincing. These scam emails would generally state that the bank account for an existing payment had changed, and would direct potential victims to send payment to an atatcker-controlled account.

Both phishing and BEC have become huge concerns in recent years. It only takes one employee within an organization to fall for a phishing scam, to give an attacker insider knowledge that is hugely beneficial in conducting further attacks. Additionally, as users have become more and more savvy regarding phishing, phishing pages have become far more sophisticated than they once were.

Figure 1. Example landing page of phishing page leveraged in BEC scam.

As these kinds of scams become increasingly sophisticated, organizations will have to take greater measures to ensure they are protected against them. Often, a successful phishing campaign allows attackers an enormous amount of access to a organization, and is relatively simple for an attacker to conduct, so it is imperative that organizations take appropriate measures to prevent these attacks.

IOCs

1sthealth[.]net/Feladoc/
account-dominicplaisance[.]net/direct/
activation-confirming-mainpage[.]com/
parkdoc/
alsonsproperties[.]com/voicemessage/one/
arind[.]net/Telefax/one/
ascententerprise[.]in/Scan/Newnew/docusi/
beautybuzzed[.]com/OneDrive/
benefitsofhoney[.]us/miracle/one/
blushhairmakeupbeauty[.]com[.]au/fastonedrive/
blushhairmakeupbeauty[.]com[.]au/One/
cacoinnatur[.]org[.]ve/dkny/one/
capitallaw[.]com[.]ng/mercy/one/
chamandelsur[.]net/kall/one/
chapapax[.]club/doc/Onedriv/
chisonia[.]com/Onedriv/
choumqnktrse[.]gq/micah/one/
confirmyour[.]stream/OneDrive/
creditwaves[.]com/powerdesign/one/
datamix[.]us/call/Aquadrive/
dhartidhorari[.]com/OneDrive/
dominique-services[.]org/Casefile/
dominique-services[.]org/vmail/365/
dynamanagement[.]net/OneDrive/
emater[.]com[.]br/data/one/
exploreitbd[.]net/OneDrive/
fagiot[.]co[.]vu/Med/OneDrive/
galacticbridge[.]com/Disk/OneOne/
groupinvestment[.]in/Disk/OneOne/
hearingaidexpert[.]co[.]in/YandAdoc/
hjks[.]in/generation/one/
host5[.]biz/filename/one/
hotelpuertasdecartagena[.]com/page/
fastonedrive/
idehijau[.]com/OneDrive/
jimezq[.]com/one/
justsixpackabs[.]com/office/
kesho-kenya[.]org/OneDrive/
khaledsabry[.]eu/pope/one/
kuiters[.]co[.]vu/Doc/OneDrive/
lethbridgecoffee[.]com/YandAdoc/
libertymerchantservices[.]com/Max/Newnew/
docusi/
limitedshelpt[.]online/Doc/OneOne/
lisetti[.]online/OneDrive/
lucioavila[.]com/doc/OneDrive/
lucioavila[.]com/OneDrive/
marcelopuente[.]com/Sharefile/
mundoestetic[.]cl/Onedriv/
oriereruer[.]info/que/fastdropbox/strdropbox/
office365/
ot-matour[.]com/profile/one/
ot-matour[.]com/voicemail/one/
perrhijosmios[.]com/fuul/Aquadrive/
personalchefbyronbay[.]com[.]au/doc/one/
preemagear[.]com/micro/login/office/
preemagear[.]com/zipdoc/
radiosusanense[.]com/doc/one/
ramminghretire[.]info/jkiu/
sdinpres22menrong[.]sch[.]id/Messagefile/
service-zfairy[.]com/cp/oneddrive/
servisanit[.]cl/domain/one/
servise-eugeniasouplet[.]com/zipdoc/
simone-hoarau[.]fr/doc/zipdov/oneddrive/
simone-hoarau[.]fr/Filedoc/oneddrive/
soutemaire[.]com/betterinvesting/one/
tablo365[.]com/VNreports/one/
top[.]com[.]ar/Ericka/drive/
upditeies-limitednow[.]net/awkazip/
upditeies-limitednow[.]net/zipfile/oneddrive/
urbansaddleranch[.]com/YandAdoc/
www[.]host5[.]biz/filename/one/
zartakin[.]net/doc/OneDrive/
zartakin[.]net/OneDrive/