A variant of the business email compromise scam, also known as BEC, created by a hacking, has managed to affect the emails of more than 700 employees of 500+ companies in 14 countries.
In a typical BEC scam, cybercriminals use emails sent to a senior employee at a company with payment instructions for an account managed by the hackers, pretending to be from the company.
Believing that the message comes from a superior, the recipient of the message makes the transfer, unaware that the money is actually going to the attackers' account.
How is this scam different?
Security researchers at Agari have discovered a new hacking group, dubbed Silent Starling, that is looking to more profitable sectors, targeting employees in sales organizations. For this reason, this new form of email fraud has been dubbed vendor email compromise (VEC).
The group consists of at least three members, all from Nigeria, while information indicates that there are at least eight other individuals offering assistance in gathering potential victims ,obtaining the fake accounts, or monitoring the infected emails for relevant information.
According to Agari, after compromising an email account, the Silent Starling gang is spying on customer communications, “collecting information, data, and critical material.”.
The targets of the fraud are employees in the finance department, who are responsible for operations related to commissions or customer accounts
Access to the victim’s emails is gained through phishing attacks.Agari identified over 70 phishing websites that the Silent Starling group used to steal their victims’ login credentials. Most of the victims (97%) are from the US, UK and Canada, with only a few coming from Central America, East Asia and Europe.
Having collected as much information as they need, the attacker can then create messages that look like they are from the real supplier. The customer has little chance of doubting the legitimacy of the communication and detecting the fraud, so they follow the payment instructions, which involve the hackers' bank account instead of the supplier's.
Agari says Silent Starling, a group that has been using this fraud method to steal millions from the global supply chain, has been active since at least 2018 and has stolen more than 20,000 emails since late last year. At one US-based company alone, the accounts of 39 employees were affected by the group.
Compared to BEC scams, the VEC approach is much more profitable. A recent report from the US Financial Crimes Enforcement Network (FinCEN) reveals that VEC scams cause average losses of $125,000 per victim, compared to the $50,000 recorded on average from BEC attacks.
