Microsoft Threat Intelligence has detected and investigated 35 million Business Email Compromise (BEC) attempts with an average of 156,000 attempts daily between April 2022 and April 2023.
Microsoft observed a 38 percent increase in Cybercrime-as-a-Service targeting business email between 2019 and 2022.
Microsoft, in its fourth edition of Cyber Signals report, has highlighted a surge in cybercriminal activity around BEC, the common tactics employed by BEC operators and how enterprises can defend against these attacks.
BEC attacks offer a great example of why cyber risk needs to be addressed in a cross-functional way with IT, compliance and cyber risk officers at the table alongside business executives and leaders, finance employees, human resource managers and others with access to employee records, said Vasu Jakkal, corporate vice president, security, compliance, identity, and management at Microsoft.
Instead of exploiting vulnerabilities in unpatched devices, BEC operators seek to exploit the daily sea of email traffic and other messages to lure victims into providing financial information or taking direct action like unknowingly sending funds to money mule accounts that help criminals perform fraudulent money.
Businesses should leverage cloud apps that utilize AI capabilities to enhance defenses, adding advanced phishing protection and suspicious forwarding detection.
Crucially, businesses need to secure identities to prohibit lateral movement by controlling access to apps and data with Zero Trust and automated identity governance, said Microsoft.
In 2022, the FBI’s Recovery Asset Team (RAT) initiated the Financial Fraud Kill Chain (FFKC) on 2,838 BEC complaints involving domestic transactions with potential losses of over $590 million.