Hackers are using thousands of legitimate emails accounts to launch impersonation and business email compromise (BEC) attacks against thousands of organizations.
Security researchers at Barracuda have spotted 6,170 malicious accounts that use popular email services (such as Gmail, AOL) to launch over 100,000 BEC attacks against nearly 6,600 organizations.
Cybercriminals use BEC scams to target companies and high level employees (such as those in finance) who conduct wire transfers and may have suppliers overseas.
The researchers first observed the attacks in January 2020. However, the experts added that since April 1, 45 percent of the BEC attacks were caused by malicious accounts.
Mike Flouton, VP of Barracuda’s email security business, described the threat in a recent blog post:
“Cybercriminals register email accounts with legitimate services to use them in impersonation and business email compromise attacks. They carefully craft these messages and, in most cases, use these email accounts only a few times to avoid detection or being blocked by email services providers.”
Barracuda
Furthermore, the attackers typically use the registered email account just a few times. However, they will change display names as part of their impersonation attempts.
In an effort to thwart reporting of suspicious accounts, the actors will also use the accounts for only a 24-hour period.
“Cybercriminals will impersonate an employee or trusted partner in an email attack. Usually, email is used first to establish contact and trust. Attackers will expect replies to their BEC attacks,” Barracuda added.
BEC safeguards
To help guard against BEC scams, Barracuda recommends these safeguards:
- Invest in protection against business email compromise (e.g., use artificial intelligence to help spot unusual senders/requests).
- Block messages from malicious accounts.
- Train your users to recognize targeted phishing attacks.
Readers may remember when “Shark Tank” star Barbara Corcoran nearly lost $400,000 to a phishing scam late last month after scammers tricked people in her office into wiring funds to a bank in Germany.
BEC scammers have also been known to target Fortune 500 companies.
In short, no organization is immune to such BEC scams.