FBI Warns Of BEC Attacks Increasingly Targeting US Govt Orgs

The Federal Bureau of Investigation (FBI) is warning US private sector companies about an increase in business email compromise (BEC) attacks targeting state, local, tribal, and territorial (SLTT) government entities.

This warning was issued via a TLP:WHITE Private Industry Notification (PIN) sent on March 17 and coordinated with DHS-CISA.

BEC scammers use social engineering, phishing, or hacking to compromise business email accounts with the end goal of redirecting pending or future payments to bank accounts under their control.

Attacks escalated after switching to remote work

“From 2018 through 2020, the FBI observed increases in business email compromise (BEC) actors targeting state, local, tribal, and territorial (SLTT) government entities for financial gain due to vulnerability exploitation and transparency requirements,” the FBI said.

“BEC actors continue to target SLTT government entities with spoofed emails, phishing attacks, vendor email compromise, and credential harvesting techniques to manipulate payment or direct deposit information.”

BEC attacks against SLTT govt orgs further intensified after the start of the COVID-19 pandemic and the rapid switch of a large part of their workforce to remote work.

Also Read: The 5 Benefits Of Outsourcing Data Protection Officer Service

After sending 40,000 emails as part of 152 phishing assessment campaigns of SLTT orgs during 2020, DHS-CISA detected around 5,500 clicks on malicious links embedded in the phishing messages (amounting to a 13,6% click rate).

Between November 2018 and September 2020, the FBI observed losses ranging from $10,000 up to $4 million, which led to considerable resource strain and significantly impaired SLTT governments’ operational capabilities.

The intelligence and security service highlighted several successful attacks against US govt entities during this time:

• In September 2020, a county government official received an email with new payment instructions from a legitimate vendor email address with whom the government had contracts. Upon failing to receive a $1.6 million payment, the vendor contacted the county who referred them to the email request. Upon forensic review, information technology personnel determined the vendor’s email address had been compromised and the new payment instructions were fraudulent.
• In December 2019, unidentified malicious actors gained unauthorized access and modified rules for the email account of the financial coordinator of an identified US territory’s government agency. The actors sent fraudulent financial transaction instructions to 146 government entities during their holiday leave. Four of the government entities transferred a total of$4 million to a fraudulent account after actors successfully intercepted and responded to further communications questioning the changes in banking information.
• In July 2019, a small city government received a spoofed email purporting to be from a known contractor requesting a change in payment method. The city complied with the request; however, after a delay in payment, the legitimate contractor contacted the city and informed them they had not requested the change. The adjusted loss to the city was approximately$3 million.
• In November 2018, a phishing attack targeting an identified county office resulted in a number of employees disclosing their account credentials. The criminal actors gained access to the system that maintained direct deposit information via the compromised accounts. The actors then diverted the employees’ paychecks to unauthorized accounts, resulting in an approximate loss of $20,000.

$1.8 billion in losses due to BEC attacks in 2020

“The FBI’s Internet Crime Complaint Center (IC3) notes BEC is an increasing and constantly evolving threat as criminal actors become more sophisticated and adapt to current events,” the FBI added.

“There was a 5 percent increase in adjusted losses from 2019 to 2020, with over $1.7 billion adjusted losses reported to IC3 in 2019 and over $1.8 billion adjusted losses reported in 2020.”

FBI’s 2020 annual report on cybercrime affecting US victims published earlier this week listed a record number of complaints and financial losses during last year.

Out of 791,790 complaints received by the Internet Crime Complaint Center (IC3), causing more than $4 billion in losses, 19,369 complaints were about BEC or email account compromise (EAC) scams and generated $1.8 billion in losses.

Also Read: How To Prevent WhatsApp Hack: 7 Best Practices

In other alerts issued last year, the FBI warned of BEC scammers exploiting cloud email services such as Microsoft Office 365 and Google G Suite, and email auto-forwarding in their attacks.