In a scam analyzed by Avanan, the victim received an e-mail declaring to be from the CFO directing them to make a payment
to their insurance provider. Image: iStock/jauhari1 Must-read security coverage Organization email compromise attacks work by using a basic phishing scheme and then lending it authority by impersonating a trusted and frequently high-ranking individual connected with the targeted company.
In a report launched Thursday, August 25, e-mail security company Avanan describes one specific fraud that spoofed the chief financial officer (CFO) of a big sports business in an attempt to steal money.
Phishing effort camouflaged as a payment demand from CFO
In this attack, the phishing email impersonated the CFO with a demand to send out a payment to their insurance provider. Asking the recipient to pay through an ACH electronic fund transfer, the e-mail consisted of a forwarded message and a connected PDF file that claimed to be a billing from West Bend Mutual, an actual insurance coverage supplier. The From address in the forwarded message noted West Bend Mutual, but the actual reply address varied from the service provider’s genuine address.
The tipoff that something was fishy came from a banner appearing at the top of the e-mail cautioning the recipient that “this e-mail might not be from the displayed sender” (Figure A). The banner was added by the company’s Office 365 setup, an useful function that alerted the user to a possible fraud.
< img src="https://d1rytvr7gmk1sx.cloudfront.net/wp-content/uploads/2022/08/BEC-spoofed-CFO-sports-company-Avanan.jpg?x27457"alt= "screenshot of phishing e-mail with a red-bannered warning at the top of the email" width ="1200"height="640"/ > Image: Avanan In a 2nd phishing project seen by Avanan, the assailants utilized the very same West Bend Mutual insurance company satire. In this one, the “Contact us”e-mail address at the bottom spelled Silver Lining as” Silver Linning.”However, there was no banner notification at the top alerting the recipient that the email addresses didn’t match.
SEE: How credential phishing attacks threaten a host of markets and companies (TechRepublic)
The very first e-mail pointed out was unsuccessful since the banner informed the user that something was incorrect. However, company email compromise attacks frequently work for a couple of various reasons.
By spoofing an executive within the targeted business, these harmful e-mails benefit from the desire by workers to please their managers and managers. These kinds of emails are likewise challenging to obstruct.
External email gateways are not able to evaluate the context of such a message. They only see that the email is from the CFO or another upper-level executive, so they permit these messages to pass. The banner that notified the user to a mismatch in the email addresses was the important defense. However too many of those banners can lead to users just ignoring them.
Worker cybersecurity education is vital says Avanon
Instead of rely on external e-mail gateways and warning banners, your best option is to proactively block these types of attacks, so workers don’t need to choose whether a message is genuine.
However, worker education is still crucial, as some volume of fake phishing e-mails are constantly going to sneak past your defenses. Toward that end, Avanan offers a number of suggestions:
- Inform users to always check the reply-to addresses in an e-mail to make certain they match.
- Instruct employees to ask the initial sender for verification if not sure about the authenticity of an email.
- Motivate users to call someone in your finance group before acting upon billings sent by means of e-mail.
- Advise employees to check out the whole email to scan for disparities, misspellings and other errors.
- Tell users to be suspicious of all messages with links and connected files.
- Advise users to share individual info just in genuine time and in person.
- If your software application or security product uses alerting banners, make sure not to bombard your users with them. Only turn to such banners at important times, so the receivers take them more seriously.
- Configure your accounts to alert you of any changes.
- Set up multi-factor authentication for all accounts, particularly email.
- Use a password manager within your company to create and store user passwords.
