This Week in Security News: BEC Attacks and Botnet Malware

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the prevalence and impact of BEC attacks. Also, find out how botnet malware can perform remote code execution, DDoS attacks and...

BEC Hack Cons Catholic Church Out of $1.75 Million

A church in Brunswick, Ohio was scammed out of a whopping $1.75 million as a result of a business email compromise BEC attack. St. Ambrose Catholic Parish, which has around 16,000 members, has been working on a massive $4 million church renovation, dubbed “Vision 20/20” – but attackers figured ou...

A look inside the FBI’s 2018 IC3 online crime report

The FBI’s Internet Crime Complaint Center have released their annual Crime Report, with the most recent release focusing on 2018. While the contents may not surprise, it definitely cements some of the bigger threats to consumers and businesses—and not all of them are particularly high tech...

FBI: BEC Scam Losses Almost Double To Reach $1.2 Billion

Business email compromise BEC scams are squeezing more money than ever out of victims, with losses from the attacks almost doubling year-over-year in 2018 to reach $1.2 billion. That’s according to the FBI’s annual Internet Crime Report IC3 for 2018, which records the number of complaints, losses...

Hit the Easy Button for Your Organization’s Gmail Security

Fifteen years ago, Gmail was launched by Google. The web-based service now has 1.5 billion users a month. In addition to being the extremely popular personal email service, Gmail is also a key component of G Suite for organizations. One of the many reasons of Gmail’s popularity is its security...

BEC Scam Gang London Blue Evolves Tactics, Targets

Prolific business email compromise group London Blue has been spotted in a recent campaign that demonstrates the group’s evolved tactics and improved targeting via an updated database. London Blue has been around since 2011 – but researchers spotted the business email compromise BEC group again i...

A week in security (March 18 – 24)

Last week on Malwarebytes Labs, we touched on the susceptibility of hospitals against phishing attacks, password reuse, the risk of interactive TV shows to side-channel attacks, and Facebook's new and out-of-character plan to promote privacy in the platform. Other cybersecurity news A study...

RSA Conference 2019: BEC Scammer Gang Takes Aim at Boy Scouts, Other Nonprofts

SAN FRANCISCO – A Nigeria-based scammer gang dubbed “Scarlet Widow” has been launching email fraud attacks against thousands of targets – including universities, the Salvation Army, and Boy Scouts of America. Researchers with Agari detailed the attack during an RSA Conference session on Tuesday...

Protecting against the next wave of advanced threats targeting Office 365 – Trend Micro Cloud App Security 2018 detection results and customer examples

Since the release of “Trend Micro Cloud App Security 2017 Report” about a year ago, threats using email as the delivery vector have grown significantly. Business Email Compromise BEC scams have already caused USD $12.5 billion in global losses as of 2018 – a 136.4% increase from the $5.3 billion...

Don’t Blame Employees who fall for a BEC scam!

The BBC reports that a media company based in Scotland is now suing a former employee who fell for a Business Email Compromise BEC scam. In the scam, the employee received emails which appeared to be from the managing director and requested wire transfers. The employee worked with her line manage...

A week in security (February 4 – 8)

Last week on Malwarebytes Labs, we took a closer look at the technical and reputational challenges for Facebook as it tries to integrate secure messaging across Messenger, WhatsApp, and Instagram. We explored Google’s latest attempts to change how the public sees—literally—web browser URLs, gave...

Using Gmail "Dot Addresses" to Commit Fraud

In Gmail addresses, the dots don't matter. The account "[email protected]" maps to the exact same address as "[email protected]" and "[email protected]" -- and so on. Note: I own none of those addresses, if they are actually valid. This fact can be used to commit fraud:...

BEC Will Reach Two Levels Deeper

In our predictions report for 2019, “Mapping the Future: Dealing with Pervasive and Persistent Threats,” we foresaw an increase in the rate of BEC business email compromise attacks: “Business email compromise will go two levels down in the org chart.” From the report: | “Business email compromise...

Shipping Firms Speared with Targeted 'Whaling' Attacks

Scammers are honing in on the shipping industry, using “whaling,” a.k.a. business email compromise BEC attacks, to scoop up credentials, or worse, compromise critical systems. Hackers are launching whaling attacks to target various types of employees with some serious online and sometimes...

ThreatList: Gift Card-Themed BEC Holiday Scams Spike

With cyber threats rampant between Black Friday and Christmas, security experts are warning of a wave of business-style email scams hitting inboxes designed to appeal to holiday shoppers. Attacks involve scam messages purporting to be gift card deals or links to corporate donations. According to...

Today’s Data Breach Environment: An Overview

By now, companies and consumers alike are well aware of the threat of a data breach. Large and small businesses across every sector have been targeted, and many customers are now familiar with the notification that their username, password or other details might have been compromised. The...

The BEC List: Helping Thwart Business Email Compromise through Collaboration

Today, the Messaging, Malware and Mobile Anti-Abuse Working Group M3AAWG gave the JD Falk Award to the Business Email Compromise BEC List. The BEC List comprises cybersecurity firms, researchers and internet infrastructure companies that help deal with cybercriminal activities and schemes. The JD...

This Week in Security News: Tracking and Hacking

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, Google revealed a secret deal with Mastercard that allows it to track what users buy offline. Also, Senate and House representatives warn th...

ThreatList: 60% of BEC Attacks Fly Under the Radar

Up to 60 percent of business email compromise BEC attacks don’t involve a malicious link, making it more difficult for employees and email security systems to spot that something is amiss, a recent report found. Researchers at Barracuda, in a new study of 3,000 BEC attacks, found that most of the...

BEC is Big Business for Hackers: What makes these attacks so hard to prevent?

For years, one of the most lucrative ways for hackers to generate profits was through ransomware attacks. These instances involve the use of strong encryption to lock victims out of their files and data - attackers then sell the decryption key in exchange for an untraceable Bitcoin ransom payment...