17.12.2024 – As a company, you are constantly in contact with your customers, often by e-mail. Project enquiries and processing, placing orders, payment and delivery modalities – many things run via this communication channel. Fraudsters can take advantage of this with a certain amount of effort, but first need precise information. If the undertaking succeeds, the damage to the victim can be enormous. A very exciting case on this topic was recently reported to the BACS.
The attackers’ plan
Attackers can gain access to very valuable information by accessing a business account:
- invoices and payment information;
- data on the projects and customers;
- Technical details of products;
- Customer relationship information.
Depending on what the attacker is up to, the same information is not always in the foreground:
- Most of the known cases of BEC are about money:
invoices are manipulated (e.g. with a new payee) and redelivered under a pretext in the hope that the invoice recipient will trigger the payment. Depending on the amount of the payment, the victim may suffer considerable damage; - Research and technical data:
competitors or other interested parties could try to catch up by inspecting sensitive documents; - Projects and offers:
With this information, a competitor can try to gain a competitive advantage and land important contracts, for example.
The case reported to the BACS and explained here should be assigned to the last point – it is probably a form of industrial espionage.
The compromise of a business account
In many cases, customer relationships and employment relationships can be found directly on the website of the respective company, often also searched for on LinkedIn.
Next, the target receives a phishing email asking them to enter the password of their email account. This brings the attackers closer to their goal – at least if two-factor authentication is not activated.
When accessing the account for the first time, the attackers often try to set up forwarding rules: In this way, they receive a copy of the victim’s complete email traffic and can remain undetected for a longer period of time.
The Deception Machinery
The “.cam” top level domain has been active for several years and was originally intended for the manufacturing industry (CAM stands for “Computer Aided Manufacturing”). Today, however, it is also used for the photo and video sector (“camera”). It was pointed out early on that “.cam” could lead to misunderstandings due to its similarity to the widely used «.com” domain. It is precisely this risk of confusion that is exploited in this case.
The fraudsters can now intervene in the communication between the customer and the company and now pretend to be the other to both the victim and their customers. For example, the fraudsters write a message from “firma-x.cam” with a request to “kunde-1.com”. The fraudsters can even return a possible answer (again to “firma-x.cam”) “firma-x.ch”, but now with the sender “kunde-1.cam”, so that the feedback is also routed through the environment of the fraudsters again.
Thus, even in the reported case, greater disaster could be averted.
Recommendations
- Raise awareness of this type of fraud among key people;
- Enable two-factor authentication on accounts (especially email) that are potentially accessible via the Internet;
- If possible, limit access to such accounts to smaller address ranges, e.g. addresses that can be assigned to Switzerland, or use a VPN;
- Periodically check forwarding rules on your email accounts;
- If there are requests for changes in payment transactions (e.g. new bank accounts), ask the recipient of the payment, preferably by telephone;
- In the event of successful compromises and financial loss, report the case to the police.
Current figures and statistics
The number of reports of the last week by category are published at:
