Download Whitepaper: Achieving SIEM Efficiency Through Proactive Validation

RESOURCES

The Persistent Threat of Business Email Compromise

Blogs
Date: Oct '24
Author: Cynode

The Persistent Threat of Business Email Compromise

Business Email Compromise (BEC) is a sophisticated type of email and identity based attack that doesn't rely on malware or malicious links. Instead, it leverages social engineering tactics to manipulate human trust and judgement. This makes BEC attacks particularly challenging to detect and prevent, even for organisations with robust protection infrastructures and cyber security awareness programmes.

The financial impact of BEC attacks is staggering. According to the FBI's Internet Crime Complaint Center (IC3), in 2023 alone, there were 21,489 BEC complaints with adjusted losses exceeding £2.3 billion. The European Union Agency for Cybersecurity (ENISA) also highlights BEC as attackers' preferred method for financial gain in its 2023 cyber threat report. This persistence can be attributed to several factors:

  • Constant evolution of attack techniques
  • Human error and social engineering vulnerabilities
  • Limitations of automated detection systems
  • Lack of comprehensive, multi-layered defence strategies

How BEC Attacks Work

A typical BEC attack begins with an "Email Account Take Over." Attackers use various techniques to gain access to a corporate email account, including:

  • Brute force attacks
  • Password spraying
  • Exploiting data from previous breaches
  • Phishing campaigns
  • Malware attacks on compromised devices

Once an account is compromised, the attacker can:

  • Impersonate key financial personnel
  • Investigate financial subjects and content that can be manipulated
  • Send fraudulent emails requesting payments or sensitive data
  • Set up email forwarding rules to gather information
  • Export sensitive documents

Detecting and Responding to BEC Attacks

To combat BEC attacks effectively, organisations need a comprehensive approach that goes beyond traditional email security measures and build capabilities to detect specific BEC related indicators of compromise in the networks. These include but not limited to: 

  • Tracking behavioural anomalies in email and cloud application usage
  • Focusing on high-risk users with access to sensitive data
  • Identifying phishing attempts from compromised accounts

When a potential BEC attack is detected, swift response is crucial. This involves:

  • Validating the compromised account and notifying the owner
  • Revoking active sessions and tokens
  • Enforcing password resets and multi-factor authenticationImplementing access limitations and isolation measures
  • Investigating potential data leaks on the dark web

Detect the Subtle Signs of BEC attempts

Whilst general cybersecurity measures and awareness programmes are essential, organisations need specialised solutions that can detect the subtle signs of BEC attempts and respond rapidly to minimise potential damage. By implementing a dedicated BEC detection and response service, organisations can:

  • Proactively identify and mitigate BEC threats
  • Minimise the risk of financial loss and reputational damage
  • Prevent the use of corporate accounts in broader attack chains
  • Enhance overall email security without overburdening IT teams

Remember, when it comes to BEC, a multi-layered approach combining technology, awareness, and BEC-specific detection and response is key to safeguarding your organisation's assets and reputation.

Explore Cynode’s Business Email Compromise Detection and Response service here: Cynode MDR for BEC

RELATED RESOURCES

    Update cookies preferences