A Special Case of Business Email Compromise
Cloudflare warns that business email compromise (BEC) phishing has assumed a new form: vendor email compromise (VEC). The classic BEC case involves the impersonation of someone within an organization, taking advantage of the trust that builds up among co-workers to induce the victims to take some action–usually transfering funds, compromising credentials, or installing malware–that’s harmful to the organization.
VEC involves a similar abuse of trust. “Like business email compromise (BEC) attacks, VEC works by impersonating a trusted third party and sending a legitimate-sounding but malicious email to a target. While traditional BEC attacks usually claim to be from a trusted individual within the organization, VEC goes one step further: it impersonates vendors (or other trusted third parties) in order to trick the target into paying fraudulent invoices, disclosing sensitive data, or granting access to corporate networks and systems.”
One way of thinking about VEC, Cloudflare explains, is to regard it as a “financial supply chain compromise.” It tends to be more sophisticated than other forms of BEC if only because it requires some preparatory work and closer targeting of the victim. “VEC generally requires a greater understanding of existing business relationships — like ongoing project details, budget data, and financial transaction schedules. This research process may take weeks to months, but the potential payoff for the attacker is far greater than more generalized attack methods, as it can take a significantly longer time for the target to identify the attack and stop payments from going through.”
And once the VEC scammers have decided on their target, and once they’ve cultivated an appropriate level of trust through such displays of familiarity with that target, “they can carry out further malicious actions: requesting payment for fake invoices, tampering with billing account details, gathering sensitive information about the targeted organization, and so on.”
An important part of an effective defense against VEC is new-school security awareness training. Informed and properly skeptical personnel are far less likely to fall for the scam, and are far more likely to offer the scammers a target too tough to crack.
Cloudflare has the story.
The world’s largest library of security awareness training content is now just a click away!
In your fight against phishing and social engineering you can now deploy the best-in-class simulated phishing platform combined with the world’s largest library of security awareness training content; including 1000+ interactive modules, videos, games, posters and newsletters.
You can now get access to our new ModStore Preview Portal to see our full library of security awareness content; you can browse, search by title, category, language or content topics.
The ModStore Preview includes:
- Interactive training modules
- Videos
- Trivia Games
- Posters and Artwork
- Newsletters and more!
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/security-awareness-training-preview-partner?partnerid=001a000001lWEoJAAW