How a Business Email Compromise attack can threaten your organization
The most common type of BEC campaign involves a spoofed email account or website, according to GreatHorn.
Image: iStock/OrnRin
Email is one of the most popular tools exploited by cybercriminals to launch attacks against organizations. It’s quick and simple and it relies on social engineering to trick the recipient into falling for whatever scam is in play. One particular tactic favored by criminals is the Business Email Compromise (BEC) in which the scammer spoofs a trusted contact to defraud a company out of money.
SEE: Cybersecurity: Let’s get tactical (free PDF)
Released on Tuesday, “The 2021 Business Email Compromise Report” from security provider GreatHorn looks at the latest in BEC campaigns. Based on a May 2021 online survey of 270 IT and cybersecurity pros in the U.S., the report reveals some of the trends, challenges and gaps involved in fighting BEC attacks and related email threats.
Asked about the most common types of BEC attacks they’ve seen, 71% of the respondents pointed to those that spoof email accounts or websites. Some 69% cited spear phishing in which specific people or roles in an organization are targeted. And 24% mentioned malware, specifically emails that contain malicious files or other content.
Drilling down, almost half of all the BEC attacks witnessed by those surveyed spoofed an individual’s identity in the displayed name. BEC emails also often include look-alike domains that resemble an actual domain as well as brand names that impersonate real brands. Some attacks rely on compromised internal or external accounts to appear more convincing.
Among spear phishing messages, cybercriminals often drop familiar information such as company names, names of specific individuals, names of bosses or managers, names of customers and names of vendors, all in an attempt to convince employees to fulfill the fraudulent request.
The survey also discovered a rise in spear phishing attacks. Some 65% of the respondents said their organization was hit by this type of attack in 2021, while more than half said that spear phishing has increased over the past 12 months. Further, 39% of those polled said they now see spear phishing attempts on a weekly basis.
Malicious emails remain a threat as well. One out of four of the respondents said that from 76% to 100% of the malware they receive is sent by email. Further, almost one out of three respondents said that more than half of the links seen in the emails they receive go to a malicious site. Some 57% of these malicious links are designed to steal internal account credentials, often from C-suite executives and finance employees. Such links also are aimed at installing malware as a setup for ransomware and payment fraud.
BEC attackers are keen to go after certain departments and roles within an organization. The most targeted department is finance, followed by the CEO and then the IT group. Other departments favored in these attacks include HR, marketing and sales.
Finally, 43% of the respondents said they were hit by a security incident over the past 12 months, with many pointing to BEC and phishing attacks as the source. As a result of the incident, 36% reported that accounts were compromised, 24% said that malware was installed, 16% said that company data was lost and 16% reported payment fraud.
To help your organization better defend itself against BEC attacks and related email threats, GreatHorn CEO and co-founder Kevin O’Brien offers the following tips:
- Focus on defense in depth and not one-stop “anti-phishing” solutions. Email can do three different things: Send text, send a link or send files. As such, you need at least three layers of defense aligned to each of these functions.
- Identify unusual emails through social graph analysis. Augment that with machine learning to speed up the identification of suspicious messages. Then add tools to detect compromised vendors, look-alike domains and executive impersonation attempts. Combined, these efforts can address social engineering or text-based attacks, such as ones that ask you to buy gift cards or share sensitive data.
- Identify unusual and malicious links in emails. Statistical analysis can help here with an additional layer of control to address zero-day attacks and credential theft attempts. Supplement this with machine vision and machine learning to spot what’s wrong when unusual URLs and links appear in emails.
Cybersecurity Insider Newsletter
Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays