Full Report
Most business email compromise (BEC) attacks start with stolen credentials, not a malicious email. Group-IB uses threat intelligence to detect compromised accounts before attackers log in — predicting BEC before it starts.
Analysis Summary
Based on the article provided, here is a summary of the techniques and tools associated with Business Email Compromise (BEC) and the predictive defense approach.
# Tool/Technique: Business Email Compromise (BEC) via Credential Theft
## Overview
Business Email Compromise (BEC) is a class of cybercrime where attackers gain access to a business email account and imitate the owner's identity to defraud the company, its employees, or its partners. Unlike traditional phishing, modern BEC increasingly relies on **stolen credentials** harvested via infostealers to bypass traditional email filters by logging in as a legitimate user.
## Technical Details
- **Type:** Technique / Attack Vector
- **Platform:** Enterprise Email Platforms (Microsoft 365, Google Workspace), Cloud Directories.
- **Capabilities:** Lateral phishing, invoice fraud, supply chain compromise, and unauthorized data access.
- **First Seen:** Continuous evolution; modern "credential-first" BEC is currently the dominant trend.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1078 - Valid Accounts]
- [T1566 - Phishing]
- **[TA0006 - Credential Access]**
- [T1539 - Steal Web Session Cookie]
- [T1555 - Credentials from Web Browsers]
- **[TA0008 - Lateral Movement]**
- [T1534 - Internal Phishing]
- **[TA0010 - Exfiltration]**
- [T1114 - Email Collection]
## Functionality
### Core Capabilities
- **Credential Harvesting:** Utilizing malware (infostealers) to capture logins and session tokens from user devices.
- **Account Takeover (ATO):** Using valid credentials to bypass perimeter defenses.
- **Lateral Phishing:** Sending malicious emails from a compromised internal account to other employees to escalate privileges.
### Advanced Features
- **Supply Chain Modeling:** Identifying and impersonating trusted third-party vendors or partners.
- **Session Hijacking:** Bypassing Multi-Factor Authentication (MFA) by utilizing stolen session cookies.
- **Retroactive Tagging:** Using threat intelligence to identify and flag historical messages sent from an account that was later determined to be compromised.
## Indicators of Compromise
- **Network Indicators:**
- Logins from anomalous geographic locations or known VPN/Tor exit nodes.
- Connections to known infostealer C2 domains (e.g., `example-c2[.]com`).
- **Behavioral Indicators:**
- Creation of new inbox forwarding rules (to hide attacker replies).
- Sudden spikes in internal-to-internal email traffic with attachments.
- Logins originating from User Agents inconsistent with corporate standards.
## Associated Threat Actors
- **BEC Groups:** Various financially motivated actors (often referred to as "Silent Starling" or "Scattered Spider" in similar contexts, though not named specifically in this article).
- **Access Brokers:** Groups that steal credentials and sell them to BEC specialists.
## Detection Methods
- **Threat Intelligence Matching:** Comparing corporate directory identities against leaked credential databases and logs from infostealer botnets.
- **Behavioral Sandboxing:** Detonating links and attachments found in internal-to-internal emails.
- **API-based Scanning:** Connecting directly to email suites to analyze traffic that bypasses the Secure Email Gateway (SEG).
## Mitigation Strategies
- **Identity Intelligence:** Proactively monitoring for employee credentials found in "stealer logs" on the Dark Web.
- **MFA Hardening:** Transitioning to FIDO2/WebAuthn to prevent session token theft and phishing.
- **Password Resets:** Triggering mandatory password changes when an account is identified in threat intelligence feeds, even before an active login is detected.
- **Internal Scanning:** Implementing security tools that inspect lateral (internal) email traffic.
## Related Tools/Techniques
- **Infostealers:** RedLine, Racoon, and Lumma (tools used to gather the initial credentials).
- **Session Token Theft:** Techniques used to bypass MFA.
- **Invoice Fraud:** The most common financial objective of a successful BEC attack.