Business Email Compromise

BEC threat actors are expanding from their traditional enterprise victims toward nonprofit and religious organizations, with a recent incident involving a church.

A new business email compromise (BEC) scheme, where attacker tricks the recipients into rerouting paychecks by direct deposit, has emerged.

The threat actor London Blue has been refining its BEC techniques and expanding its scope for both targets and regions.

A business email compromise (BEC) scheme took more than $100 million from Facebook and Google. Legitimate-looking invoices, contracts and more fooled the two tech companies and they wired millions to the fraudsters over a period of years.

Brute-force attacks against user accounts in cloud services prove that multifactor authentication is only one part of an effective multilayered security implementation.

As cybersecurity technology becomes better at detecting email-based threats, attackers continue to employ leveled up social engineering tactics – such as phishing – to increase the likelihood of users falling for fraud, identity theft, or spoofing.

To provide organizations a comprehensive view of the email threat landscape, we look at notable occurrences of advanced email threats used by cybercriminals as well as advanced security techniques that can effectively defend against them.

Looking back at the most significant issues of 2018, we saw shifting cybercriminal strategies and lingering security threats. Enterprises faced a multitude of challenges, but careful study of these issues can present opportunities for improvement.

As of 2018, global losses to BEC have exceeded US$12 billion. To keep abreast of the landscape that scammers are operating in, we look back on some of the noteworthy incidents and trends that made BEC a headline staple this year.