Trend Micro Cloud App Security Report 2019

BEC remains a big business for cybercriminals

BEC is big business: According to the FBI, BEC scams amounted to US$1.7 billion in exposed losses in 2019 — half of the year’s total losses due to cybercrime. It remains a major thorn in the side of organizations, as the number of BEC attempts detected by Trend Micro Cloud App Security rose significantly from just over 100,000 in 2018 to nearly 400,000 in 2019 — a 271% increase. Furthermore, the percentage of BEC attempts out of the total number of email threats detected tripled from the previous year.

An interesting shift can be seen in the significantly higher percentage of BEC detections that were caught by authorship analysis via AI and machine learning — from 7% in 2018 to 21% in 2019. Given that this stage follows behavior and intention analysis, it appears BEC operators are getting smarter and exploring beyond the usual social engineering tricks.

BEC scams have been on the rise in the past few years. Cybercriminals tend to rely on what’s worked before, and this was still true for 2019. Fake invoices requiring wire transfer payments sent via email remained a prominent BEC technique, while scams involving gift cards, which were already gaining steam in previous years, became one of the most popular methods for conducting BEC scams in the fourth quarter of 2019. Gift card scams eliminate the need for a middleman or for accounts that could potentially be shut down by banks and law enforcement, thus guaranteeing a virtually “hands-free” transaction for BEC scammers. The FBI also noted that some incidents were accompanied by wire transfer requests.

A gift card scam detected by Trend Micro Cloud App Security. Scams such as these are more informal, and thus more unlikely to be perceived as a threat.

Aside from the usual methods, BEC scammers have also started evolving their techniques. For example, one notable change is how the use of CEO fraud, in which cybercriminals impersonate an organization’s chief executive officer, is on the decline. In a 2019 report, the U.S. Treasury Department’s Financial Crimes Enforcement Network said CEO fraud accounted for only 12% of sampled incidents in 2018, down from 33% in 2017 — indicating that BEC threat actors are starting to look for newer, perhaps more accessible, targets.

Cybercriminals are also expanding their social engineering tricks. Traditionally, BEC threat actors relied on fake invoices requiring wire transfer payments sent via email. Last year, the London Blue group started using email messages that notified the target organization of acquisition terms of an overseas vendor — with the caveat that 30% of the purchase price had to be wired. Another incident in December saw cybercriminals compromising the account of one of the employees of a Chinese venture capital firm. They then spoofed the domain of an Israeli startup company the victim organization had dealings with and eventually walked away with US$1 million originally meant for seed funding. 

A sample of a BEC email using the acquisition scam detected by Trend Micro Cloud App Security. It seems to be a preliminary email, as no amount is mentioned yet.

Fraudsters have also taken aim at nonprofit organizations. Some prominent events from 2019 include the theft of US$2.3 million from the Manor Independent School District in Texas and an attack on an Ohio church that led to US$1.75 million in losses. Local governments were not spared either, as incidents in 2019 such as those in North Carolina and Georgia led to millions of dollars in losses in the U.S.

Malware attacks use new delivery and evasion methods

The number of malware detections dipped in 2019 — to roughly 960,000 from over a million in 2018. But malware variants seen throughout the year weren’t lacking in capabilities.

On the surface, there seems nothing particularly special about a 2019 campaign launched by the Cloud Atlas/Inception group; like many other phishing campaigns, it took aim at high-value targets via phishing emails. What made these attempts notable was the malicious attachment it used: The Microsoft Office document contained malicious remote templates loaded from remote servers — an obfuscation technique meant to allow the document to evade both static and forensic analysis.

Furthermore, the templates executed a malicious HTML application, which then executed a malicious backdoor. Both the HTML application and the backdoor were polymorphic — they constantly modified their attributes to avoid detection. The final payload included a component designed to steal documents and send them to a command-and-control (C&C) server, and a password grabber from the compromised machine.

The use of ISO files to deliver malware became more common. In August, we found the LokiBot malware being delivered via spam emails containing malicious ISO attachments and using steganography to hide its tracks. In the same month, we reported on the cybercriminal group TA505, which also used ISO attachments to drop the remote access trojan (RAT) FlawedAmmyy.

Last year saw the proliferation of RATs in spam and phishing campaigns. In July, Trend Micro researchers found a phishing email delivering the Remcos RAT, a multifunctional tool with remote execution and data theft capabilities. It also used a number of obfuscation and anti-debugging techniques to evade detection. That same month, another campaign with multistage payloads — Imminent Monitor RAT and Proyecto RAT — targeted financial and government organizations in South America. The group behind the attack used a service that allowed the creation of throwaway email addresses for its C&C server. Another malicious spam campaign caught by Trend Micro honeypots involved a pair of AutoIT-compiled payloads — the trojan spy Negasteal (aka Agent Tesla) and the Ave Maria (aka Warzone) RAT.

Protect your email and collaboration tools in the cloud with Trend Micro Cloud App Security

Email-based threats remained rampant in 2019. BEC has proved a lucrative venture for cybercriminals, a factor which, in addition to the variety in potential scams, is behind the significant increase in detected attempts. Moreover, the number of unknown links used for credential phishing shows that new campaigns are constantly being launched — either by new threat actors or by experienced cybercriminals refreshing old schemes. On the other hand, while malware detections were down slightly, 2019 proved to be a year in which more sophisticated techniques were employed to deliver malware.

A major takeaway that can be gleaned from the email threat landscape is that a single security gateway or service is no longer enough to protect organizations from email-based threats — especially with the move to cloud-based enterprise tools. Businesses, no matter the size, are at risk from a plethora of dangers that these kinds of threats pose.

Organizations should consider a comprehensive multilayered security solution such as Trend Micro Cloud App Security. It supplements the preexisting security features in email and collaboration platforms like Office 365 and G Suite by using machine learning to analyze and detect any suspicious content in the message body and attachments of an email.

Trend Micro Cloud App Security uses technologies such as sandbox malware analysis, document exploit detection, and file, email, and web reputation technologies to detect malware hidden in Office 365 or PDF documents. It provides data loss prevention (DLP) and advanced malware protection for Box, Dropbox, Google Drive, SharePoint Online, and OneDrive for Business, while also enabling consistent DLP policies across multiple cloud-based applications. It also offers seamless integration with an organization’s existing cloud setup, preserving full user and administrator functionality, providing direct cloud-to-cloud integration through vendor APIs, and minimizing the need for additional resources by assessing threat risks before sandbox malware analysis.

Trend Micro Cloud App Security stands on the cutting edge of email and software-as-a-service (SaaS) security, offering machine learning-powered features that combat two of the primary email-based threats: BEC and credential phishing. Writing Style DNA can help determine if an email is legitimate by using machine learning to check a user’s writing style based on past emails and then comparing suspicious emails against it. Computer vision, on the other hand, combines image analysis and machine learning to check branded elements, login forms, and other site content. It then pools this information with site reputation elements and optical character recognition (OCR) to check for fake and malicious sites — while reducing instances of false positives.

Even with the best security technology in place, the human element remains an important part of creating a rock-solid security implementation. Businesses need to ensure that their employees are educated on email threats and know how to recognize and react to these kinds of attacks. This includes examining messages for any grammatical errors and spelling mistakes, which are red flags that are often present in malicious emails. Users should also be vigilant when responding to or acting on an email, especially if it involves financial matters.

Organizations can avail of a free assessment test for email and endpoint security. It uses Trend Micro Cloud App Security to scan mailboxes for any potential threats.