Business email compromise (BEC) attacks increasingly are targeting accounts payable departments and attempting to establish trust via email exchanges before launching an attack.
Ken Liao, vice president of marketing at Abnormal Security, says people who work in finance or accounts payable often don't know every vendor – many companies have hundreds, even thousands of vendors and suppliers.
"The AP people are lower in the organization, but they still have the ability to make large payments," Liao says. "The criminals impersonate the vendor by folding into the natural workflow."
The numbers don't lie: In a report released today, Abnormal Security saw a 28% increase in the size and frequency of BEC attacks over the fourth quarter of 2019 and a 17% increase in large campaigns aimed at 10 or more recipients. Individual BEC attacks targeting the C-suite dropped by 37%.
According to the report, BEC attackers maintain a targeted approach, but strategically group victims to gain social validity and increase the chances of engagement. When cybercriminals "engage" a victim, they typically don't go for the money in the first email. They slowly create trust by simply asking for a form, or a small piece of information that appears like a legitimate request.
"If an attacker goes after an AP person in a way that fits the role of their job, the victim has no reason to doubt," says Chris Hadnagy, CEO of Social-Engineer LLC. "The BEC attackers have stopped going for the large C-suite players because the media covers it so much and people are aware of those attacks. Plus, people are working from home and ..
Support the originator by clicking the read the rest link below.
