Microsoft Threat Intelligence detected and investigated 35 million Business Email Compromise (BEC) attempts with an average of 156,000 attempts daily between April 2022 and April 2023, the tech giant revealed on Friday.
Microsoft also observed a 38 percent increase in Cybercrime-as-a-Service targeting business email between 2019 and 2022.
In its fourth edition of a Cyber Signals report, Microsoft highlighted a surge in cybercriminal activity around BEC, the common tactics employed by BEC operators, And how enterprises can defend against these attacks.
“BEC attacks offer a great example of why cyber risk needs to be addressed in a cross-functional way with IT, compliance, and cyber risk officers at the table alongside business executives and leaders, finance employees, human resource managers, and others with access to employee records,” said Vasu Jakkal, corporate vice president, security, compliance, identity, and management at Microsoft.
“While we must enhance existing defenses through AI capabilities and phishing protection, enterprises also need to train employees to spot warning signs to prevent BEC attacks,” he added.
Instead of exploiting vulnerabilities in unpatched devices, BEC operators seek to exploit the daily sea of email traffic and other messages to lure victims into providing financial information or taking direct action like unknowingly sending funds to money mule accounts that help criminals perform fraudulent money.
To protect against BEC attacks, businesses should leverage cloud apps that utilize AI capabilities to enhance defenses, adding advanced phishing protection and suspicious forwarding detection.
Crucially, businesses need to secure identities to prohibit lateral movement by controlling access to apps and data with Zero Trust and automated identity governance, said Microsoft.
In 2022, the FBI’s Recovery Asset Team (RAT) initiated the Financial Fraud Kill Chain (FFKC) on 2,838 BEC complaints involving domestic transactions with potential losses of over $590 million.
