How to Identify Phishing and BEC Email Attacks

419 scam/advance-fee scam: Made famous in the earlier days of email with messages from faux-Nigerian princes. This scam promises a large payout in exchange for an up-front payment. The criminal claims that they have access to a large amount of money, but need your help to access it, and in exchange for your help, you’ll be rewarded. Payments are requested in the form of irreversible transfers through wire transfer like Western Union, cryptocurrency like Bitcoin, or anonymized purchases like bulk gift cards. Once this money is sent, it is gone, and you won’t receive any promised payment.

Romance scam: The ultimate catfish. This long-con starts with generically appealing dating profiles and messages. When a potential victim reaches out, the criminal (and often, their team) spend hours plugging scripted responses into chat, email, and even phone calls. Then, months into the faked relationship, the criminal presents a problem. Perhaps they’ve lost their job and need emergency funds to pay rent. Maybe they got stranded in their travels, were robbed, and need help getting home. The initial monetary request could start out small, or the first hit could be for everything in the victim’s savings account. Often the criminal will continue to prey on a romance victim until they finally become suspicious or the source of funds dries up.

Phishing: We’ve talked a lot about phishing on our blog and website, and it is never too soon for a refresher. Think you’re a phishing expert? Take our quiz and see if you can find the reasons these emails are safe or scary.

BEC (Business Email Compromise): When directed at corporate or organizational accounts, phishing and other scams are referred to as BEC scams. The goal of BEC scams is to receive information, account credentials, and money on a scale larger than individual targets could provide.

While BEC scams are often long-term, highly targeted scams that involve masquerading as vendors or high-level employees requesting (and receiving!) wire transfers of large amounts of money, the criminals who engage in mass-email phishing attempts are the same criminals who engage in romance schemes, business espionage, and classically-known BEC scams. This results in aspects of other scams frequently appearing across the board.

Information gained in lower level attacks is used to ramp up and hone in on higher dollar targets. One stolen password may not correspond to a direct attack to the user, but that stolen password (and the information gained from the compromised account) could result in millions of dollars lost from that user’s employer years later.

Part of what makes this particular email so interesting is that it showcases just how multiple attack victims (likely accumulated by the cybercriminals over time and gained through different scams, phishes, and attacks) can be used to build bigger and more successful attacks. It is also part of a late-2020 trend: Microsoft is the most frequently mimicked brand in phishing attacks.

The resolution to this story is mixed.

Many users clicked to access their “Secure Message” and provided their login information to criminals. Not only was the sender’s account information stolen and used for the criminal’s own ends, but clearly the criminal (and their team) also performed a similar attack on the STEM site’s personnel to gain access to their website’s backend, and without alerting them, created the fake login honeypot.

The URL was eventually flagged for phishing and malicious activity, and many browsers now block access to that address, preventing further use of that particular trap. The client who encountered the phish had passwords reset by the Anderson Technologies team and their accounts remain closely monitored.

But the question remains: Would you click?

Cyber and email security training is a key part of any organization’s IT. Interested in scheduling a training session, or assessing solutions that can augment email safety? Take the time to build solutions and safety nets before a breach.