Large-Scale Phishing Campaign Bypasses MFA

Microsoft researchers have uncovered a massive phishing campaign that can steal credentials even if a user has multi-factor authentication MFA enabled and has so far attempted to compromise more than 10,000 organizations. The campaign, which has been active since September 2021, depends upon the...

From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud

A large-scale phishing campaign that used adversary-in-the-middle AiTM phishing sites stole passwords, hijacked a user’s sign-in session, and skipped the authentication process even if the user had enabled multifactor authentication MFA. The attackers then used the stolen credentials and session...

Talos EMEA monthly update: Business email compromise

The latest edition of the Talos EMEA Monthly Update is available now on Cisco.com and Cisco's YouTube page. You can also view the episode in its entirety above. For June, Hazel and Martin got together to discuss business email compromise. BEC has quickly become the most lucrative attack vector...

Cybercrime Syndicate Leader Behind Phishing and BEC Scams Arrested in Nigeria

By Deeba Ahmed Cyber security companies across the globe helped Interpol bust an unnamed cybercriminal being large-scale BEC scams and phishing… This is a post from HackRead.com Read the original post: Cybercrime Syndicate Leader Behind Phishing and BEC Scams Arrested in Nigeria...

Interpol Arrests Leader of SilverTerrier Cybercrime Gang Behind BEC Attacks

A year-long international investigation has resulted in the arrest of the suspected head of the SilverTerrier cybercrime group by the Nigeria Police Force. "The suspect is alleged to have run a transnational cybercrime syndicate that launched mass phishing campaigns and business email compromise...

The $43 billion Business Email Compromise threat

The FBI has released a public service announcement regarding the ever-present threat of Business Email Compromise BEC. This comes hot on the heels of an earlier release from the Las Vegas FBI department in April. Losses continue to mount, and were currently facing a scam racking up domestic and...

Interpol Busted 11 Members of Nigerian BEC Cybercrime Gang

A coordinated law enforcement operation has resulted in the arrest of 11 members allegedly belonging to a Nigerian cybercrime gang notorious for perpetrating business email compromise BEC attacks targeting more than 50,000 victims in recent years. The disruption of the BEC network is the result o...

Tiny Font Size Fools Email Filters in BEC Phishing

A new business email compromise BEC campaign targeting Microsoft 365 users is using a range of sophisticated obfuscation tactics within phishing emails that can fool natural language processing filters and are undetectable to end users. Researchers at Avanan, a CheckPoint company, first discovere...

bec-ede.nl Improper Access Control vulnerability OBB-2240478

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Quarterly Report: Incident Response trends from Q3 2021

Ransomware again dominated the threat landscape, while BEC grew By David Liebenberg and Caitlin Huey. Once again, ransomware was the most dominant threat observed in Cisco Talos Incident Response CTIR engagements this quarter. CTIR helped resolve several significant... This is only the beginning!...

Analyzing Email Services Abused for Business Email Compromise

We analyzed five major types of email channels, and the techniques in keywords and domain names BEC actors use to appear legitimate to potential victims...

Analyzing Email Services Abused for Business Email Compromise

We analyzed five major types of email channels, and the techniques in keywords and domain names BEC actors use to appear legitimate to potential victims...

Cybersecurity Firm Group-IB's CEO Arrested Over Treason Charges in Russia

Russian authorities on Wednesday arrested and detained Ilya Sachkov, the founder of cybersecurity firm Group-IB, for two months in Moscow on charges of state treason following a search of its office on September 28. The Russian company, which is headquartered in Singapore, confirmed the developme...

Europol nabs 106 criminals involved in SIM swapping, money laundering

By Waqas Europol said that the suspects carried out a number of cybercrimes included phishing, SIM Swapping, and BEC business email compromise. This is a post from HackRead.com Read the original post: Europol nabs 106 criminals involved in SIM swapping, money laundering...

Romance, BEC Scams Lands Soldier in Jail for 46 Months

A former Army reservist was just sentenced to 46 months in prison and ordered to pay nearly $2 million in penalties and restitution, after pleading guilty to scamming dozens of people online, including the elderly and a veteran’s organization for Marines. Joseph Iorhemba Asan Jr. along with his...

BEC Scammers Seek Native English Speakers on Underground

Looking for work? Speak fluent English? Capable of convincingly portraying a professional – as in, somebody a highly ranked corporate leader would talk to? If you lack scruples and disregard those pesky things called “laws,” it could be your lucky day: Cybercrooks are putting up help-wanted ads,...

Cybercrime Group Asking Insiders for Help in Planting Ransomware

A Nigerian threat actor has been observed attempting to recruit employees by offering them to pay $1 million in bitcoins to deploy Black Kingdom ransomware on companies' networks as part of an insider threat scheme. "The sender tells the employee that if they're able to deploy ransomware on a...

Best Practices to Thwart Business Email Compromise (BEC) Attacks

Business email compromise BEC refers to all types of email attacks that do not have payloads. Although there are numerous types, there are essentially two main mechanisms through which attackers penetrate organizations utilizing BEC techniques, spoofing and account take-over attacks. In a recent...

Judge drops hammer, dishes 7 years slammer for BEC and romance scammer

A Texas resident has finally paid the price for a heady mix of malicious mail antics. A combination of business email compromise BEC scams and romance fakeouts bagged them $2.2 million across roughly 6 years. This is quite a divergent portfolio of scamming activity. You may typically assume BEC...

A week in security (June 21 – June 27)

Last week on Malwarebytes Labs: Want to stop ransomware attacks? Send the cybercriminals to jail, says Brian Honan: Lock and Code S02E11 Atomic research institute breached via VPN vulnerability Hotel staff bust Hermes SMS scammer with suspiciously large number of cables City of Liège hit by...