BEC Attackers Spoof CCd Execs to Force Payment
Armorblox explained.
Without proper hindsight, this email replay looks like a legitimate response coming from his or her trusted executive or manager. This only adds to the sense of urgency to pay the invoice, and increases the risk of financial loss for the organization upon compliance with this request.
With both supplier and now their boss urging prompt payment, its more likely that the victim will go ahead and process the transfer, the security vendor argued.
However, there are still ways to mitigate the impact of such attacks. Armorblox pointed to several techniques which security teams should be able to use:
Detection of spoofed sender and executive domains
Use of large language models (LLMs) to detect a sense of urgency in the email and the payment request. When combined with the presence of spoofed domains, this should flag the email as fraudulent
Use of machine learning and deep learning models to detect characteristics indicating a combination of VIP Impersonation Fraud and External Payment Fraud attacks
Related to This Story
BEC Group Uses Open Source Tactics in Hundreds of Attacks
#ScamsAwarenessFortnight – Adopting a Zero Trust Mindset to Tackle Fraud
Global Police Arrest Thousands in Fraud Crackdown
Malicious Email Surge Predicted for Q4
Barclays: 2020 the Highest Year on Record for Scams