Vane3alga

Business
Focused
Technology

A business email compromise (BEC) gang has launched more than 350 attacks against organizations in the US, according to researchers at Abnormal Security. The threat actor, which Abnormal Security tracks as “Firebrick Ostrich,” conducts open-source reconnaissance on their targets in order to construct their scam.

“In contrast to other forms of financial supply chain compromise where an attacker has deep insight into a specific vendor/customer relationship, third-party reconnaissance occurs when an attacker knows that there is a relationship between two organizations but has limited or no knowledge about actual outstanding payments,” the researchers write. “In essence, an attacker in these cases has the necessary context to impersonate a vendor but not enough information to be specific in their payment request.”

Cybercriminal Uses Direct Social Engineering

The threat actor then sends the customer organization an invoice posing as the vendor.

“Once an attacker has collected this information, they will then initiate their attack by impersonating the vendor and emailing the customer, inquiring about a potential outstanding payment,” the researchers write. “Because the attacker doesn’t have specific knowledge about an actual overdue invoice, these initial emails tend to be more general requests—rather than containing specific details that might be found in a traditional vendor email compromise attack.”

In addition, the threat actors can ask the victim to change the vendor’s banking information, so that future payments will be sent to the attackers until the vendor notices they haven’t been paid.

“Instead of requesting payment for a current invoice, another tactic that a threat actor might use is to simply request that a vendor’s stored bank account details be updated so any future payments get redirected to the new account,” the researchers explain. “This tactic is a little more stealthy, as the attacker isn’t requesting an immediate payment—the red flag accounts payable specialists are taught to notice. These attackers are playing a longer game, hoping that a simple request now will result in a payment to their redirected account with the next payment.”

Abnormal Security has the story.


Source: KnowBe4

Success Stories

Principal Owner, Marketing Firm

Bringing IT360 on as our technology services “department” was one of the smartest business decisions we’ve made. Over the years, we’ve tried various similar services and have also hired internal IT staff, and we’ve never felt confident that we were adequately supported. IT360 has changed all that. They not only provide proactive, comprehensive technical support and consulting, they engage with us in a way that feels like they are part of our company…a true business partner.

Principal Owner, Marketing Firm

Recent
Technology News

IT360 News
Summer Travel = Cyber Risk

How to stay secure on the go with it360 As summer kicks into full gear, many professionals find themselves working from new locations—whether it’s a vacation rental, a hotel lobby, or the occasional airport gate. While flexible work environments can boost morale and productivity, they also introduce a new wave of cybersecurity risks. We want […]

Read more
IT360 News
Halfway Through 2025: Is Your Tech Strategy on Track?

A mid-year check-in from it360 As we reach the midpoint of 2025, it’s a great time to pause and reflect: is your current IT strategy truly supporting your business goals? We encourage you to use this moment as a strategic checkpoint—to assess performance, identify gaps, and plan with purpose for the second half of the […]

Read more