Published: August 13, 2020 on our newsletter Security Fraud News & Alerts Newsletter.
Chalk one up for Microsoft in the era of coronavirus. It all began with the company dismantling business email compromise (BEC) attacks in December of last year, where hackers used malicious web apps for their crimes. The company’s Digital Crimes Unit (DCU) recently found the same criminals are now involved in using the Coronavirus pandemic as cover for attacks in 62 countries. Armed with a court order, Microsoft seized control of the malicious domains used by the cybercriminals and thwarting their ability for further harm.
The goal of BEC scams is to compromise accounts, steal information, and redirect wire transfers. The FBI’s 2019 Internet Crime Report noted BEC attacks cost enterprises over $1.7 billion, totaling nearly half of all financial losses from cybercrime. BEC fraud uses emails that address potential victims by name and appear to be from trusted co-workers or vendors; often they appear to be from someone with a high level of authority such as a vice president or even C-Level. They can contain malware-filled attachments and links to infected domains like those discovered by Microsoft. The recent efforts using coronavirus for BEC themes exploit financial concerns related to the pandemic and are more likely to be opened and acted upon. According to research from Check Point, more than 51,000 coronavirus-themed domains were registered globally between January and March of this year.
It’s no surprise that cybercriminals take advantage of current events, and coronavirus-themed lures are a hot topic these days. Although coronavirus headlines grab our attention, BEC attacks can be thwarted by using basic anti-phishing tactics. Always require two-factor authentication on all business and personal accounts as an added layer of identity verification. Don’t fall for urgently themed subjects and contents such as those using coronavirus, since hackers use them to grab attention and get recipients to act quickly. Links and attachments, especially those from unknown or suspicious senders, should never be acted upon without first verifying their legitimacy. Finally, let common sense be the cure for email phishing. Emails with bad grammar, misspellings, and other questionable content should be deleted without further thought.
Keep up to date: Sign up for our Fraud alerts and Updates newsletter
Want to schedule a conversation? Please email us at advisor@nadicent.com