Business Email Compromise Attempts: How Will It Happen?
As we already discussed this month, Compromised Email Attacks (BEC) are on the rise and everyone is at risk of being a victim. It would be nice if these attacks were uniform although the attacks and the attackers come in all shapes and sizes. To better protect yourself against these types of attacks it is vital to educate yourself on the different methods these attackers are using to strike.
One of the more common ways these attacks are happening is through phishing and more specifically, spear-phishing. Spear-phishing is when a potential victim receives an email from what appears to be a legitimate and trustworthy source. For example, an email could come through with a personal contact’s name although, if you were to click on the "contact" within the email you would find that the email address is not that of your contact. This is because you can attach any name you would like to an email address when you set it up. Since it looks like a personal contact, you are more likely to open this email and inside there could be a link to a bogus website that again looks legit but when clicked upon, downloads malware to the victim’s computer granting access to the network to the criminal.
Another common BEC attack is through email spoofing. Email spoofing is very similar to spear-phishing in that the email appears to be legit. The difference is that the email has been slightly altered to look like a reliable email although it may have one or more characters changed. For example, it might seem like Mary@Contoso.com although it actually is, Mary@C0ntoso.com mailto:Mary@C0ntoso.com (using a zero instead of "O"). Like spear-phishing, many times these emails have malware embedded in the body of the email. Other times, these emails request personal information regarding network or asset information knowing that most will not verify the email and immediately send the data on as the email appears to have authority.
Social Engineering is a broad umbrella of attack types although pretexting and quid pro quo are two of the most common attacks under this umbrella. Pretexting is when a criminal uses an intriguing platform to draw in and capture its victim’s attention. One of the more common platforms the criminals may use is a monetary enticement. For example, the email may state that you are the beneficiary to a family member’s will. Once the victim is hooked by the “story,” the criminal tries to trick his victim into providing personal data.
Quid pro quo is precisely as it sounds. The criminal requests information from its victim in return for something. For example, one that I personally have received repeatedly is a call from “Microsoft” saying my license is out of date and that “Microsoft” needs my password to update my device. The attempt is to get you to grant them access to your computer, and once they are in, they are able to install malware and monitor all systems to devise a plan of attack. These attacks can come through the phone or over email and just remember, Microsoft will never call or email to request your password!
We are all potential targets for BEC. These are the ultimate tricksters who know how to con most anyone out of information so always be suspicious of anything that may seem a bit out of the ordinary. If in question, never click on an email and immediately contact your Pendello Solutions team of experts. Let us investigate the suspicion instead of you risking your entire network and risking your company having financial devastation.
At Pendello Solutions, we turn technology hurdles into powerful assets. Our technology solutions fuel growth, productivity, and efficiency, through continuous innovation and strategic solutions, empowering your business beyond the imaginable. Contact us today to discover the Pendello Method.