Thirty-five million business email compromise (BEC) attempts were detected in the last year, according to the latest Microsoft Cyber Signals report. Credit: CHUYN / Getty Images Cybersecurity activity around business email compromise (BEC) spiked between April 2022 and April 2023, with over 150,000 daily attempts, on average, detected by the Microsoft Microsoft’s Digital Crimes Unit (DCU).The findings were highlighted in the latest edition of Microsoft’s Cyber Signals, a cyberthreat intelligence report that spotlights security trends and insights gathered from Microsoft’s 43 trillion security signals and 8,500 security experts.“BEC attacks stand apart in the cybercrime industry for their emphasis on social engineering and the art of deception,” said Vasu Jakkal, corporate vice president of security, in a blog post. “Successful BEC attacks cost organizations hundreds of millions of dollars annually.”BEC attempts rose significantlyMicrosoft’s DCU observed a 38% increase in cybercrime as a service (CaaS) attacks that targeted business email between 2019 and 2022, according to the report. There have also been 417,678 takedowns of unique phishing URLs directed by the DCU between May 2022 and April 2023. Between April 2022 and April 2023, Microsoft detected and investigated 35 million BEC attempts with an average of 156,000 attempts daily.“In 2022, the FBI’s Recovery Asset Team (RAT) initiated the Financial Fraud Kill Chain (FFKC) on 2,838 BEC complaints involving domestic transactions with potential losses of more than USD590 million,” Jakkal said. Rather than targeting unpatched devices for vulnerabilities, BEC operators focus on leveraging the vast volume of daily email and other message traffic to trick victims into sharing financial information or unknowingly transferring funds to money mule accounts. Their goal is to exploit the constant flow of communication to carry out fraudulent money transfers.Tactics used in business email compromiseThreat actors employ various methods when attempting business email compromise, which can involve phone calls, text messages, emails, or social media, according to the report. They use techniques like sending fake authentication requests or pretending to be individuals or companies to deceive their targets.Topics used to trick victims in BEC attacks include, for example, payroll, invoice, gift card and business information themes, Microsoft said.In addition, Microsoft has noticed a pattern in attackers’ utilization of platforms such as BulletProftLink. This CaaS platform is widely used for creating large-scale malicious email campaigns and offers a comprehensive service that includes templates, hosting, and automated features specifically designed for BEC. Moreover, adversaries who employ this service are supplied with IP addresses that assist in directing their BEC targeting efforts. Cybersecurity professionals and law enforcement agencies are concerned that these new tactics in BEC attacks make it difficult to determine the location of threat actors, potentially leading to a surge in large-scale attacks.“Although, threat actors have created specialized tools to facilitate BEC, including phishing kits and lists of verified email addresses targeting C-suite leaders, accounts payable leads, and other specific roles, there are methods that enterprises can employ to pre-empt attacks and mitigate risk,” Jakkal said. Using secure email applications, securing identities to block lateral movement, adopting a secure payment platform and training employees are a few effective methods, according to the report. Related content news Multibillion-dollar cybersecurity training market fails to fix the supply-demand imbalance Despite money pouring into programs around the world, training organizations have not managed to ensure employment for professionals, while entry-level professionals are finding it hard to land a job By Samira Sarraf Oct 02, 2023 6 mins CSO and CISO CSO and CISO CSO and CISO news Royal family’s website suffers Russia-linked cyberattack Pro-Russian hacker group KillNet took responsibility for the attack days after King Charles condemned the invasion of Ukraine. By Michael Hill Oct 02, 2023 2 mins DDoS Cyberattacks feature 10 things you should know about navigating the dark web A lot can be found in the shadows of the internet from sensitive stolen data to attack tools for sale, the dark web is a trove of risks for enterprises. Here are a few things to know and navigate safely. By Rosalyn Page Oct 02, 2023 13 mins Cybercrime Security news ShadowSyndicate Cybercrime gang has used 7 ransomware families over the past year Researchers from Group-IB believe it's likely the group is an independent affiliate working for multiple ransomware-as-a-service operations By Lucian Constantin Oct 02, 2023 4 mins Hacker Groups Ransomware Cybercrime Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe