- Joined
- Jun 13, 2020
- Messages
- 6,541
- Reaction score
- 891
- Points
- 212
- Awards
- 2
The attackers did not use malware, they "just" stole email credentials.
Experienced cybercriminals stole $ 15 million from a US company in a carefully crafted fraudulent operation that lasted for two months.
According to the BleepingComputer portal, the cyberattack can be confidently called a piece of jewelry. First, the attackers gained access to e-mails about the transfer of funds, and then infiltrated negotiations and redirected payments to fake accounts. At the same time, they managed to hide the fact of theft for a long time and manage to withdraw the stolen money.
Although Mitiga investigators only examined this specific case, they found evidence that the list of victims of cybercriminals includes dozens of enterprises, including architectural firms, financial organizations and law firms.
According to experts, no malicious software was found in the networks of the affected company, but the fact of compromising e-mail credentials was revealed. However, access to an email account was not enough for cybercriminals, since they could lose it at any time. In this regard, the cybercriminals created rules for forwarding letters in order to receive all incoming letters from the desired mailbox.
Cybercriminals used the Microsoft Office 365 email service to spoof the domains of two parties involved in the transaction. Using Microsoft Office 365 has allowed them to make emails unsuspecting and able to bypass security solutions. In addition, the attackers registered two domains through the domain registrar GoDaddy, very similar to domains belonging to real companies.
For four weeks, the cybercriminals methodically followed the plan, using information gathered from intercepted emails from the attacked company's top management. When it came to discussing the transfer of money, they "wedged in" the conversation from a fake domain, similar to the domain of one of the parties to the negotiations, and provided fake bank details.
Banks can block money transactions if funds are transferred to the wrong account, and cybercriminals prepared for this in advance. In order to hide the theft, they transferred money to accounts in foreign banks and confused the trail. The cybercriminals also created filtering rules, according to which messages from certain email addresses were sent to a hidden folder. Therefore, the legitimate owners of e-mail boxes have not seen letters discussing the transfer of money. Thus, the attackers "earned" $ 15 million in two weeks.
Experienced cybercriminals stole $ 15 million from a US company in a carefully crafted fraudulent operation that lasted for two months.
According to the BleepingComputer portal, the cyberattack can be confidently called a piece of jewelry. First, the attackers gained access to e-mails about the transfer of funds, and then infiltrated negotiations and redirected payments to fake accounts. At the same time, they managed to hide the fact of theft for a long time and manage to withdraw the stolen money.
Although Mitiga investigators only examined this specific case, they found evidence that the list of victims of cybercriminals includes dozens of enterprises, including architectural firms, financial organizations and law firms.
According to experts, no malicious software was found in the networks of the affected company, but the fact of compromising e-mail credentials was revealed. However, access to an email account was not enough for cybercriminals, since they could lose it at any time. In this regard, the cybercriminals created rules for forwarding letters in order to receive all incoming letters from the desired mailbox.
Cybercriminals used the Microsoft Office 365 email service to spoof the domains of two parties involved in the transaction. Using Microsoft Office 365 has allowed them to make emails unsuspecting and able to bypass security solutions. In addition, the attackers registered two domains through the domain registrar GoDaddy, very similar to domains belonging to real companies.
For four weeks, the cybercriminals methodically followed the plan, using information gathered from intercepted emails from the attacked company's top management. When it came to discussing the transfer of money, they "wedged in" the conversation from a fake domain, similar to the domain of one of the parties to the negotiations, and provided fake bank details.
Banks can block money transactions if funds are transferred to the wrong account, and cybercriminals prepared for this in advance. In order to hide the theft, they transferred money to accounts in foreign banks and confused the trail. The cybercriminals also created filtering rules, according to which messages from certain email addresses were sent to a hidden folder. Therefore, the legitimate owners of e-mail boxes have not seen letters discussing the transfer of money. Thus, the attackers "earned" $ 15 million in two weeks.