Full Report
A business email compromise (BEC) attack is a type of scam where bad actors impersonate a trusted source to obtain information from their targeted individual.
Analysis Summary
# Tool/Technique: Business Email Compromise (BEC)
## Overview
Business Email Compromise (BEC) is a sophisticated form of cyber-enabled fraud where threat actors impersonate a trusted source—such as a CEO, vendor, or colleague—to manipulate individuals into performing unauthorized financial transfers or disclosing sensitive corporate information. Unlike traditional volume-based phishing, BEC is highly targeted and relies heavily on social engineering and identity deception.
## Technical Details
- **Type**: Technique / Social Engineering Framework
- **Platform**: Microsoft 365, Google Workspace (GWS), and other enterprise email environments.
- **Capabilities**: Identity impersonation, Adversary-in-the-Middle (AiTM) proxying, session token theft, and automated financial fraud.
- **First Seen**: Though active for over a decade, the modern AI-enhanced variant has seen a significant surge in 2024-2025.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- [T1078 - Valid Accounts]
- **[TA0006 - Credential Access]**
- [T1557 - Adversary-in-the-Middle]
- [T1111 - Two-Factor Authentication Evasion]
- **[TA0007 - Discovery]**
- [T1087 - Account Discovery]
- **[TA0003 - Persistence]**
- [T1137 - Office Application Startup] (Mail forwarding rules)
## Functionality
### Core Capabilities
- **Reconnaissance**: Gathering organizational data (roles, hierarchy, and vendor relationships) via LinkedIn, company websites, and previous data breaches.
- **Impersonation**: Using look-alike domains (typosquatting) or display name deception to appear as a trusted entity.
- **Account Takeover (ATO)**: Gaining full control of a legitimate user's inbox to monitor conversations and interject at opportune moments (e.g., during an invoice payment cycle).
### Advanced Features
- **Generative AI Integration**: Using Large Language Models (LLMs) to craft perfect, error-free emails that mimic the specific writing style and tone of a targeted executive.
- **AiTM (Adversary-in-the-Middle)**: Utilizing proxy tools to bypass Multi-Factor Authentication (MFA) by capturing session cookies in real-time.
- **Identity Abuse**: Exploiting Azure/Entra ID administrative privileges to create persistence or modify tenant-level settings.
## Indicators of Compromise
- **File Hashes**: Not typically applicable (BEC is often "fileless"), but malicious attachments may include HTML files used for credential harvesting.
- **Network Indicators**:
- `[anomalous-login-location].com`
- `[typosquatted-vendor-domain].net`
- Use of known VPN or VPS hosting IP addresses for initial login.
- **Behavioral Indicators**:
- Creation of new "Inbox Rules" (e.g., moving all incoming mail from a specific vendor to the "Deleted Items" or a hidden folder).
- Anomalous User Agent strings (e.g., a user who always uses Windows/Chrome suddenly appearing via a Linux/Python script).
- Logins from geographically impossible locations within a short timeframe.
## Associated Threat Actors
- **Scattered Spider** (Known for social engineering/ATO)
- **Various West-African (e.g., Nigerian) Fraud Syndicates**
- **General Cybercrime Groups** targeting financial departments.
## Detection Methods
- **Behavioral Detection**: Monitoring for the creation of suspicious mail forwarding rules or "Mark as Read" rules immediately following a login from a new device.
- **Identity Analysis**: Identifying logins from anomalous User Agents or non-standard service providers.
- **Authentication Logs**: Tracking MFA fatigue attempts or successful logins that bypass MFA via session hijacking.
## Mitigation Strategies
- **Technical Controls**: Implement Phishing-Resistant MFA (e.g., FIDO2/WebAuthn), enforce strict SPF, DKIM, and DMARC policies.
- **Process Controls**: Establish "Out-of-Band" verification for any changes to payment instructions or wire transfer requests (e.g., a mandatory phone call to a known number).
- **Hardening**: Disable legacy authentication protocols and restrict administrative roles in Microsoft 365/Google Workspace.
## Related Tools/Techniques
- **Evilginx2 / Muraena**: Frameworks used for AiTM attacks to bypass MFA.
- **Typosquatting**: Registering domains that look similar to the target's domain.
- **Social Engineering**: The broader psychological manipulation tactic underpinning BEC.