Anatomy of an Attack
Business Email Compromise comes in many forms. These are sham security alerts, last-minute payment requests, bogus past-due statements, fraudulent wiring instructions and more. Ninety-six percent of businesses have been hit, to the tune of $12.5 billion in losses since 2013. And the danger grows daily.
Phase 1
PreparationBuild Target List
Cybercriminals start by building a target list, often using business contact databases, mining LinkedIn profiles, and even scouring the target's website to identify key individuals and relationships.
Phase 2
ExecutionLaunch Attack
Attackers launch BEC campaigns, sending email to their targeted list. BEC attacks have no malicious payload and will use impersonation tactics like display name deception, spoofing, or look-alike domains.
Phase 3
DeceptionApply Social Engineering
To convince the victim to take action, attackers impersonate people of authority such as the CEO or CFO and project urgency within the request.
Phase 4
ActionReap Rewards
With trust, authority, and urgency established, the victim proceeds with the request. Unfortunately, the results end with great financial loss or a data breach.
