BEC Group Uses Manufactured Email Threads and Brand Impersonation to Facilitate Invoice Fraud
After the recent meteoric rise in social engineering attacks, security leaders are working to better educate their workforces on how to spot and report potential threats. Unfortunately, scammers consistently remain a step ahead. By the time a company becomes adept at identifying and preventing one type of threat, attackers have already evolved their tactics to something even harder to detect.
Recently, we identified a new trend in business email compromise attacks that combines vendor impersonation and executive impersonation within a single email attack. Now, a group known as Cobalt Terrapin is consistently leveraging this tactic to deceive accounting professionals and commit invoice fraud.
Cobalt Terrapin appears to be located in Turkey and has been active since at least March 2022. The group commonly impersonates well-known vendors, like LinkedIn and ZoomInfo, and has discovered a stealthy practice for bypassing legacy security systems.
While many BEC attacks appear to originate from a high-ranking individual at an organization or from a well-known vendor, Cobalt Terrapin uses a new hybrid strategy that combines both tactics. This makes communications look and feel even more legitimate.
In this case, the attacker sends an email impersonating a company executive—usually the company’s CEO or CFO—using display name spoofing. They also set up a manufactured message from a vendor in the body of the email below the message from the executive making it appear like the sender is forwarding an existing thread.
The email instructs the recipient, typically a generic email address like ap[@]company.com or accounting[@]company.com to pay the outstanding invoice referenced in the manufactured email chain below. It is notable that, rather than identifying specific individuals to target, Cobalt Terrapin identifies the central accounts payable email list they can use to reach all of the employees on that list at once. In many ways, this is likely to make them more successful as they can reach multiple people at once, and it only causes one hurried or distracted employee to make the mistake.
Attackers also recognize that if an invoice looks different from usual, it might set off alarm bells to the accounting team. To address this, Cobalt Terrapin emails include a note explaining that the company has made “improvements” to its invoices as part of an “ongoing commitment to deliver a better billing experience” and recommends the recipient check out the vendor’s website to “learn more about your new invoice.”
Although these emails typically reference an attached email, attackers wait until the targeted employee responds before sending a fake invoice or W-9. This helps them bypass security tools that flag attachments as a sign of potential attacks. And given the frequency with which people forget to attach files to emails, most email users wouldn’t consider this unusual or suspicious behavior.
Social engineering methods like those commonly used in business email compromise attacks are growing more sophisticated because it’s becoming more challenging to fool security-aware workforces and bypass security software. But attacks like those perpetrated by Cobalt Terrapin prove scammers know how to covertly manipulate multiple email elements in their favor. The fact that they are using a combination of vendor and executive impersonation, domain spoofing, and legitimate-looking invoices shows just how far they’re willing to go run their scams.
To bolster your security, educate staff on emerging threats and remind them to always carefully examine senders’ email addresses, particularly when emails contain requests to pay invoices, transfer funds, or handle any other finance-related task. It’s also vital for email recipients to verify unusual requests through another channel, like a text message or phone call.
With thanks to the Cyber Defence Alliance and Abnormal Security. The full story is here: https://abnormalsecurity.com/blog/cobalt-terrapin-invoice-fraud
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW