BEC Attacks to Exceed $9B in 2018: Trend Micro

Business email compromise (BEC) attacks are projected to exceed $9 billion in 2018. To put that number in context, it has been less than a year since the FBI reported BEC attacks had become a $5.3 billion industry. Attacks have become more sophisticated as hackers improve their game.

BEC has grown among threat actors due to "its relative simplicity," according to a new Trend Micro report "Tracking Trends in Business Email Compromise (BEC) Schemes." Researchers analyzed BEC as a cybercriminal operation from January through September 2017, dissecting tools and strategies commonly used in these attacks to predict activity for this year.

"This particular type of attack is not going away -- it's only increasing," says Ed Cabrera, chief cybersecurity officer at Trend Micro.

The Internet Crime Complaint Center (IC3) puts BEC attacks in five categories: Bogus Invoice Schemes, CEO Fraud, Account Compromise, Attorney Impersonation, and Data Theft. In this case, researchers split them in two: Credential-grabbing and Email-only. Attackers must be proficient in at least one of these methods for the scheme to work, researchers report.

Method 1: Snatching credentials

This tactic leverages keyloggers and phishing kits to steal credentials and access an organizations email. Researchers noticed an uptick in phishing HTML pages sent as spam attachments which, while not new, is still effective against unsuspecting users.

Phishing is one of the primary methods used to steal email login data for BEC attacks. Once an attacker compromises a Gmail account, for example, they can impersonate its owner or use personal information or credentials they find in the account.

The other credential-grabbing technique uses malware, which continues to be a problem for targets using antivirus tools because some attackers use crypter services to evade AV detection. Researchers note BEC actors are more frequently using phishing attacks over keyloggers because they're simpler and cheaper; actors don't need to shell out for builders and crypters.

Keyloggers and remote access tools (RATs) are the most common types of malware used for BEC because they're effective and inexpensive. Unlike attacks that rely on phishing to steal a single set of credentials, malware can collect all stored credentials on an infected machine.

Ardamax is one example of a keylogger found in recent BEC attacks. It's cheap (under $50), can send stolen data via SMPT or FTP, has webcam and microphone recording, and an option to export encrypted logs that users can browse in its log viewer. Lokibot, password stealer and coin wallet stealer, is another commonly used malware. A new version of Lokibot was found in 2017 with new features like the ability to capture screenshots on the target machine.

Method 2: Targeting inboxes

Email-only BEC attacks, which rely on social engineering, are getting more sophisticated as attackers get smarter. This tactic involves sending an email to someone in the target company's finance department, requesting an exec to transfer money as payment or as a personal favor. Usually, a spoofed email from the CEO is sent to the head of finance.

"The CFO has the authority and ability to request last-minute money transfers within the organizations," says Cabrera. "[Attackers] are trying to capitalize on the relationship between the CEO and CFO."

Cybercriminals launching BEC attacks carefully research their victims. "It's usually the advanced groups, but it's also almost akin to cyberespionage," he continues. "They have a healthy knowledge of who they're targeting, and who in the organization they're going to target."

This research is what makes them successful. Attackers want to know about the organization and its executives: who's on vacation, typical work hours, business travel. They want to know news surrounding the business and operations such as M&A activity and corporate events. Oftentimes actors target ADP credentials and payment/benefits information so they can better understand the employees they're targeting. All of this data, both public and private, leads to success.

"We're seeing a shift: 'How do we compromise email infrastructure and dig even deeper?'" Cabrera notes.

Social engineering scams can be tough to spot. Sometimes the subject line will give an attacker away; based on analysis of BEC email samples, more than two-thirds had subjects containing terms "request," "payment," or "urgent." Many said "wire transfer request" and "wire request."

In the "Reply To" line, many attackers add their email addresses so they can view replies from target recipients. Most email clients don't show the reply-to addresses, so they get away with it. If they don't do this, they create a legitimate-looking email address to impersonate a corporate executive. These usually involve free webmail services like "accountant.com" and "workmail.com."

"From a user side, awareness and training is critical," says Cabrera. "From the boardroom down to the server room, make sure [employees] know this is actually happening." He also advises taking a close look at gateway tools, what they're deploying, and how they can protect email.

"You need to understand the gateway is a critical line of defense and we need to be able to defend it," he adds.