Technique
technique:business_e_mail_compromise
Also: BEC
Fraud technique involving impersonation of a known business contact to induce a victim to redirect or make payments.
Fraud technique involving impersonation of a known business contact to induce a victim to redirect or make payments.
“BEC stands for Business E-mail Compromise”
“BEC is basically a phishing attack, but you’re posing as someone that the victim knows already.”
Financially motivated fraud involving deceptive business email communications, often directing victims to transfer money or provide credentials without necessarily using malware.
“BEC is business e-mail compromise.”
“for a vast majority of business e-mail compromise, there is no malware tied to that”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Credential phishing | Explicit | 141 |
| outgoing | ASSOCIATED_WITH | phishing | Explicit | 141 |
| outgoing | USES | typosquatting | Explicit | 141 |
| outgoing | ASSOCIATED_WITH | 419 scams | Explicit | 141 |
| incoming | INVOLVES | Evaldas Rimasauskas BEC scam | Explicit | 124 |
| incoming | USES | Evaldas Rimasauskas | Explicit | 124 |
| incoming | USES | Ronnie Tokazowski | Explicit | 141 |
| incoming | USES | Black Axe | Attributed | 141 |
| incoming | USES | Scattered Canary | Explicit | 141 |
Evaldas Rimasauskas BEC scam INVOLVES Business E-mail Compromise
The scam used what the episode calls a Business E-mail Compromise, or BEC, scam.
Explicit Confidence 99% · Jack Rhysider EP 124 Details
“Evaldas took this a step further, conducting what’s called a BEC scam.”
Evaldas Rimasauskas USES Business E-mail Compromise
Evaldas conducted a BEC scam to redirect corporate payments.
Explicit Confidence 99% · Jack Rhysider EP 124 Details
“Evaldas took this a step further, conducting what’s called a BEC scam.”
Ronnie Tokazowski USES Business E-mail Compromise
Ronnie says he has spent eight years fighting business e-mail compromise.
Explicit Confidence 99% · Ronnie Tokazowski EP 141 Details
“I’ve been fighting business e-mail compromise for the last eight years now”
Business E-mail Compromise USES Credential phishing
Ronnie says that, in some BEC cases, attackers harvest e-mail credentials and passwords through credential phishing.
Explicit Confidence 97% · Ronnie Tokazowski EP 141 Details
“At most they will do credential phishing where they’ll try and harvest the e-mail credentials and e-mail passwords”
Business E-mail Compromise ASSOCIATED_WITH phishing
Ronnie describes phishing as the overarching term for e-mail-based threats, while distinguishing it from financially motivated BEC.
Explicit Confidence 96% · Ronnie Tokazowski EP 141 Details
“phishing is kind of the overarching term for any e-mail-based threat like that”
Business E-mail Compromise USES typosquatting
BEC operators may register a domain one letter away from a legitimate business domain to impersonate a trusted party.
Explicit Confidence 97% · Jack Rhysider EP 141 Details
“register a domain that’s one letter off from the real one”
Black Axe USES Business E-mail Compromise
Ronnie says BEC activity is tied, from an attribution perspective, to groups such as Black Axe.
Attributed Confidence 88% · Ronnie Tokazowski EP 141 Details
“from an attribution perspective, this ties back to groups such as Black Axe”
Scattered Canary USES Business E-mail Compromise
Ronnie identifies Scattered Canary as a mostly Nigerian cyber-fraud group engaging in BEC since 2018.
Explicit Confidence 99% · Ronnie Tokazowski EP 141 Details
“Scattered Canary was a mostly-Nigerian cyber-fraud group that we found back in 2018 that was engaging in business e-mail compromise”
Business E-mail Compromise ASSOCIATED_WITH 419 scams
Ronnie says BEC was not a new crime but developed from or was connected to the same actors behind Nigerian 419 scams.
Explicit Confidence 95% · Ronnie Tokazowski EP 141 Details
“the scammers behind business e-mail compromise are the same people who have been doing these Nigerian prince scams for years”