THREAT SPOTLIGHT: MALICIOUS ACCOUNTS IN BUSINESS EMAIL COMPROMISE

Beware of cybercriminals who create accounts with legitimate email services and use them to launch impersonation and business email compromise (BEC) attacks.

- Mike Flouton

Since the beginning of 2020, researchers at Barracuda have identified 6,170 malicious accounts that use Gmail, AOL, and other email services and were responsible for more than 100,000 BEC attacks on nearly 6,600 organizations. In fact, since April 1, malicious accounts have been behind 45 percent of the BEC attacks detected.

Let’s have a closer look at how cybercriminals are launching attacks with these accounts, along with solutions to help protect your business by detecting, blocking, and remediating the evolving threats.

HIGHLIGHTED THREAT

Malicious accounts: Cybercriminals register email accounts with legitimate services to use them in impersonation and business email compromise attacks. They carefully craft these messages and, in most cases, use these email accounts only a few times to avoid detection or being blocked by email service providers. Each of these email addresses used in BEC attacks is defined as a malicious account and provides insight into how cybercriminals use email accounts in their schemes.

THE DETAILS

Malicious accounts were responsible for 45 percent of all BEC attacks detected since April 1, 2020. These repeat offenders created multiple attacks, targeting multiple organizations from the same email accounts.

Cybercriminals preferred choice of email service for malicious accounts is Gmail, which makes sense because it’s accessible, free, easy to register, and has a high enough reputation to pass through email security filters.