fbpx Threat Spotlight: Malicious accounts in business email compromise | Superhub

This website is using cookies.

We use only non-persistent cookies that are essential for the normal functionality of the site. No personal data are stored in our cookies.

Beware of cybercriminals who create accounts with legitimate email services and use them to launch impersonation and business email compromise (BEC) attacks.

Since the beginning of 2020, researchers at Barracuda have identified 6,170 malicious accounts that use Gmail, AOL, and other email services and were responsible for more than 100,000 BEC attacks on nearly 6,600 organizations. In fact, since April 1, malicious accounts have been behind 45 percent of the BEC attacks detected.

More than 6,000 malicious accounts that use Gmail, AOL and other legitimate #email services have been responsible for more than 100,000 #BEC attacks on nearly 6,600 organizations.

Here’s a closer look at how cybercriminals are launching attacks with these accounts, along with solutions to help protect your business by detecting, blocking, and remediating the evolving threats.

 

Highlighted Threat

Malicious accounts — Cybercriminals register email accounts with legitimate services to use them in impersonation and business email compromise attacks. They carefully craft these messages and, in most cases, use these email accounts only a few times to avoid detection or being blocked by email services providers. Each of these email addresses used in BEC attacks is defined as a malicious account and provides insight into how cybercriminals use email accounts in their schemes.

 

The Details

Malicious accounts were responsible for 45 percent of all BEC attacks detected since April 1, 2020. These repeat offenders created multiple attacks, targeting multiple organizations from the same email accounts. 

 

barracuda_malicious_blog_duration

 

Cybercriminals preferred choice of email service for malicious accounts is Gmail, which makes sense because it’s accessible, free, easy to register, and has a high enough reputation to pass through email security filters.

Although the same email address will be used multiple times, attackers will change display names for their impersonation attempts.

 

barracuda_blog_mailicious_top5

 

Most of the time, cybercriminals don’t use their malicious accounts for a long period of time. In fact, we saw 29 percent of malicious accounts used for only a 24-hour period. There are several reasons for the short life span of these accounts:

 

·         Malicious accounts may get reported and suspended by email providers

·         It’s easy for cybercriminals to register new accounts

·         Cybercriminals may temporarily abandon an account after initial attacks and then return to it after a long period of time

 

While most malicious accounts are used by attackers for a short period of time, some cybercriminals used these accounts to launch attacks for over a year. It’s not unusual for cybercriminals to return and re-use an email address in attacks after a long break.

 

barracuda_malicious_blog_durationofuse

 

By nature, business email compromise is a highly targeted attack. After an initial research period, cybercriminals will impersonate an employee or trusted partner in an email attack. Usually, email is used first to establish contact and trust. Attackers will expect replies to their BEC attacks. Therefore, these attacks are usually very low volume and highly personalized to ensure a higher chance of reply. The number of email attacks sent by a malicious account ranged from one to over 600 emails, with the average being only 19.

 Barracuda_13 email threat

barracuda_malicious_blog_emailattack

 

Having analyzed attacks on 6,600 organizations, Barracuda researchers found that in many cases cybercriminals used the same email addresses to attack different organizations. The number of organizations attacked by each malicious account ranged from one to a single mass scale attack that impacted 256 organizations — 4 percent of all the organizations included in this research.

 

barracuda_malicious

 

How to protect your organization from malicious accounts

 

·         Invest in protection against business email compromise. Cybercriminals design BEC attacks to bypass email gateways. That’s why they only use each malicious account in a small number of attacks to avoid detection. Leveraging artificial intelligence to identify unusual senders, requests, and other communications will help detect BEC attacks and other fraud.

·         Block messages from malicious accounts. Identifying accounts used by attackers is not always easy. Cybercriminals use techniques like spoofing that may make it difficult to identify the actual account used in an attack. Given the small volume of attacks coming from a single malicious account, it’s unlikely that the same organization will be targeted by two different BEC attacks coming from the same email account. Working with a vendor that can share this type of threat intelligence between different organizations in real time will allow for a greater level of protection.

·         Train your users to recognize targeted phishing attacks. User training should always be part of your security posture. Make sure your employees know how to recognize messages that come from outside of your organization and are aware of the latest tactics used by cybercriminals.

 

 Contact our Cloud Advisor for Free Consultation

 

Source: https://bit.ly/3e0n25y 

Superhub
Font Size:
  • A
  • A
  • A
  • Support
  • Web Mail
EN
  • #worksmarter with Superhub
  • 202111_Barracuda_Campaign_Terms&Conditions
  • 3HK Teams Offer
  • 5 New Ways to Achieve More in the Modern Workplace
  • Biz Sol Questionnaire
  • CEC Calendar
  • CEC Calendar Detail
  • Compare Plan Form – M365
  • Consultation Form – Azure
  • D-Biz Fund Offer
  • Enquiries for D-Biz Program
  • Enquiries for Law Tech Fund Program
  • Evaluation form (Adobe 18 Feb)
  • Evaluation form (Adobe 6 May)
  • Evaluation form (AEC 15Sept)
  • Evaluation form (App365 21 Jun)
  • Evaluation form (AVD 21 Apr)
  • Evaluation form (Azure 7Dec)
  • Evaluation form (AzureMediaServices 20Oct)
  • Evaluation form (Barracuda 16Nov)
  • Evaluation form (Barracuda 21Jan2022)
  • Evaluation form (Barracuda 25May2022)
  • Evaluation form (CloudAppSecurity 19Oct)
  • Evaluation form (Covid Care Apps 26 Apr)
  • Evaluation form (D-Biz)
  • Evaluation form (DMS 22Jul)
  • Evaluation form (EMS 16Sept)
  • Evaluation form (Fortinet 17Jun)
  • Evaluation form (GalaxyOne x ESi)
  • Evaluation form (Manage+ 27May)
  • Evaluation form (Modern+ 29 Mar)
  • Evaluation form (MS x VMware 15 Feb)
  • Evaluation form (MS-SMB-2022)
  • Evaluation form (ParaDM on Azure 26Aug)
  • Evaluation form (Phone+ 12 Apr)
  • Evaluation form (PowerBI 4Nov)
  • Evaluation form (Safeti+ 17 Mar)
  • Evaluation form (Security 12Aug)
  • Evaluation form (Security 22Jun)
  • Evaluation form (Sophos 28 April)
  • Evaluation form (Sophos 2Dec)
  • Evaluation form (Superhub M365 x App365)
  • Evaluation form (Superhub SharePoint Intranet)
  • Evaluation form (Superhub x Achiever)
  • Evaluation form (Superhub x Barracuda)
  • Evaluation form (Superhub x Bigazines)
  • Evaluation form (Superhub x Fortinet x Microsoft)
  • Evaluation form (Superhub x Jabra)
  • Evaluation form (Superhub x Veeam)
  • Evaluation form (Teams 28Sept)
  • Evaluation form (Teams Voice 24Jun)
  • Evaluation form (Viva 23Feb)
  • Evaluation form (Windows365 29Sept)
  • FAQ Form – WVD Website
  • Form
  • Form – WVD Website
  • Fortinet OnDemand Form
  • Free Consultation form – BCP
  • Free Trial Form – M365
  • General Form
  • General Form
  • header-test
  • Jabra Bundle Offer
  • Jabra free demo form
  • KL-Apr20-PPT
  • KL-Apr2021-ToDo
  • KL-Aug20-Whiteboard
  • KL-Aug2021-Forms
  • KL-Dec19-Teams2
  • KL-Dec2020-Lists
  • KL-Dec2021-Teams
  • KL-Feb20-OneNote
  • KL-Feb2021-Teams
  • KL-Jan20-Outlook
  • KL-Jan2021-Polls
  • KL-Jul19-OneDrive
  • KL-Jul19-OneNote
  • KL-Jul19-PowerPoint
  • KL-Jul20-Excel
  • KL-Jul2021-Outlook
  • KL-Jun20-Excel
  • KL-Jun2021-Teams
  • KL-Mar20-Teams
  • KL-Mar2021-Approvals
  • KL-May20-Excel
  • KL-May2021-Outlook
  • KL-Nov19-Planner
  • KL-Nov2020-planner
  • KL-Nov2021-VivaInsights
  • KL-Oct19-OneDrive
  • KL-Oct2020-Excel
  • KL-Oct2021-Whiteboard
  • KL-Sept19-Teams
  • KL-Sept2020-Teams
  • KL-Sept2021-Edge
  • Knowledge Library
  • Knowledge Library – Outlook
  • Knowledge Library (Lite Version)
  • Knowledge Library Detail
  • Leaflet Form – WVD Website
  • Legal
  • M365 Brochure-website
  • Market Leader in Cloud Solutions
  • Microsoft SharePoint Demo Form
  • Monthly Tips
  • Monthly Tips Detail
  • Our Clients
  • Our Clients Detail
  • Our Updates / Our News
  • Our Updates / Our News Detail
  • Overview
  • Partner Overview
  • Partner seminar evaluation form
  • Partner Sign Up Form
  • Partnership Models
  • Product – Adobe Document Cloud – Adobe Acrobat
  • Product – Adobe Document Cloud – Adobe Acrobat Sign
  • Product – App365+ – Benefits
  • Product – App365+ – Features
  • Product – App365+ – Overview
  • Product – Azure AAD / AADC
  • Product – Azure ASR / DR
  • Product – Azure File server / Back Up
  • Product – Azure Virtual Desktop – Overview
  • Product – Business Applications – Teams Advanced Solutions
  • Product – CloudBackup 365 – Overview
  • Product – CloudBackup365 – Features
  • Product – CloudBackup365 – Why?
  • Product – Domain and Web – Domain Name
  • Product – Dynamics 365 – Dymanics 365 Business Central Essentials
  • Product – Dynamics 365 – Overview
  • Product – Email Archiving – Key Features
  • Product – Email Archiving – Overview
  • Product – Email Signature – Example Signature
  • Product – Email Signature – Overview
  • Product – Enterprise Mobility – Compare Plans
  • Product – Enterprise Mobility – Features
  • Product – Enterprise Mobility – Overview
  • Product – Exchange Online – Compare Plans
  • Product – Exchange Online – Overview
  • Product – Exchange Online – Superhub “+”
  • Product – Hosted Exchange – Compare Plans
  • Product – Hosted Exchange – Features
  • Product – Hosted Exchange – Overview
  • Product – Hosted Exchange – Why?
  • Product – HR365 – Benefits
  • Product – HR365 – Features
  • Product – HR365 – Overview
  • Product – Microsoft 365+ – Compare Plans (201912)
  • Product – Microsoft 365+ – Future Reference
  • Product – Microsoft 365+ – Learn More
  • Product – Microsoft 365+ – Mini Page – Compare Plans
  • Product – Microsoft 365+ – Overview
  • Product – Microsoft 365+ – Overview (201912)
  • Product – Microsoft 365+ – Product Page
  • Product – Microsoft 365+ – Product Page – Old Draft
  • Product – Microsoft 365+ – Product Page-Old
  • Product – Microsoft 365+ – Superhub “+”
  • Product – Microsoft 365+ – Superhub “+” (201912)
  • Product – Microsoft 365+ – What does M365 do? (201912)
  • Product – Office 365 Backup – Features
  • Product – Office 365 Backup – Overview
  • Product – Office 365 Backup – Why?
  • Product – Office 365+ – Compare Plans
  • Product – Office 365+ – Compare Plans
  • Product – Office 365+ – Migration
  • Product – Office 365+ – Office Suite
  • Product – Office 365+ – Overview
  • Product – Office 365+ – Superhub “+”
  • Product – Office 365+ Training – Compare Plans
  • Product – Office 365+ Training – Overview
  • Product – Office 365+ Training – Why training with Superhub?
  • Product – ParaDM SmartShare
  • Product – Professional & Managed Service – Modern Workplace
  • Product – SharePoint – Overview
  • Product – Superhub Azure + – Managed Azure Service
  • Product – Superhub Azure + – Overview
  • Product – Superhub Azure + – Overview (Old)
  • Product – Superhub Azure + – Overview Old Version
  • Product – Superhub Azure + – Sample Solutions
  • Product – Superhub Azure + Web Hosting – Features
  • Product – Superhub Azure + Web Hosting – Overview
  • Product – Superhub Azure +- Features
  • Product – Superhub Azure Web Hosting – Why
  • Product – Superhub Azure+ – Benefit
  • Product – Superhub Azure+ Bundle – ADFS Connect
  • Product – Superhub Azure+ Bundle – Identity Sync
  • Product – Superhub Azure+ Bundle – Why?
  • Product – Teams Voice – Features
  • Product – Teams Voice – Overview (old)
  • Product seminar evaluation form
  • Promotion Order Page
  • Resources/Blog and Trend
  • Resources/Blog and Trend Detail
  • Solutions – Managed & Adoption Services – Business Solutions
  • Solutions – Managed & Adoption Services – Cloud Infrastructure
  • Solutions – Managed & Adoption Services – Modern Workplace
  • Solutions – Managed & Adoption Services – Product Training Service – Course Outline
  • Solutions – Managed & Adoption Services – Product Training Service – Overview
  • Solutions – Managed & Adoption Services – Security – Cybersecurity Awareness
  • Solutions – Managed & Adoption Services – Security – Microsoft Security Workshops
  • Solutions – Managed & Adoption Services – Security – Overview
  • Solutions – Other Solutions – Email Signature
  • Solutions – Other Solutions – Hybrid Cloud
  • Solutions – Other Solutions – Overview
  • Solutions – Other Solutions – Talent Management
  • Super Customer Awards – Terms and Conditions
  • Superhub Cloud Adoption Survey
  • Superhub COVID-19 Survey
  • Superhub COVID-19 Survey Cover
  • Superhub D-Biz | #worksmarter
  • Superhub D-Biz Cover
  • Superhub D-Biz Survey
  • Superhub Shop Now
  • Superhub Teams Offer
  • Superhub Webinar Evaluation Form
  • Superhub x ACT Form
  • Teams Room Open Day Register
  • Technologies – Business Solutions – Apps365 – eLeave
  • Technologies – Business Solutions – Microsoft Power BI
  • Technologies – Business Solutions – Microsoft Power BI_Maintenance
  • Technologies – Business Solutions – Microsoft Power Platform – Maintenance
  • Technologies – Business Solutions – Microsoft Power Platform – Overview
  • Technologies – Cloud Infrastructure – VMware AVS_Maintenance
  • Technologies – Cloud Infrastructure – VMware Horizon_Maintenance
  • Technologies – Modern Workplace – Adobe
  • Technologies – Modern Workplace – Microsoft Teams
  • Technologies – Modern Workplace – Microsoft Teams Phone
  • Technologies – Modern Workplace – Microsoft Teams Phone (Updating)
  • Technologies – Modern Workplace – Windows365
  • Technologies – Modern Workplace – Windows365_maintenance
  • Technologies – Security – Barracuda
  • Technologies – Security – Fortinet
  • Technologies – Security – Fortinet_Maintenance
  • Technologies – Security – Sophos_Maintenance
  • Terms
  • About Us
  • About Us (Backup)
  • Benefits
  • Culture and Values
  • Our Leadership
  • Privacy Policy
  • Terms of Service
  • Super Customer Award
  • Why Superhub
  • Why Superhub (backup)
  • Contact Sales
  • Contact Support
  • Login
  • Products
  • Guide Documents
  • Service Forms
  • Contact Us
  • Frequently Asked Questions
  • How-to
  • Service Links
  • How-to-detail
  • Contact & Payment
  • Help Center
  • How-To & FAQ Articles
  • Technologies
    Technologies
    • Modern Workplace
      1. Office 365
      2. Microsoft 365
      3. Windows 365
      4. Microsoft Teams
      5. Microsoft Teams Phone
      6. Dropsuite
      7. MailVault
      8. Crossware
    • Security
      1. Microsoft Enterprise Mobility Security (EMS)
      2. Barracuda
      3. Sophos
      4. Fortinet
    • Cloud Infrastructure
      1. Microsoft Azure
      2. Azure Virtual Desktop
    • Business Solutions
      1. App365
      2. Adobe
      3. Powell Teams
      4. Microsoft SharePoint
      5. Microsoft Power Platform
      6. Microsoft Power BI
      7. Microsoft Dynamic 365
    • Exchange Email and Domain
      1. Exchange Online
      2. Hosted Exchanged
      3. Domain Name
  • Solutions
    Solutions
    • Managed and Adoption Services
      1. Modern Workplace
      2. Cloud Infrastructure
      3. Business Solutions
      4. Security
    • Other Solutions
      1. Back Up
      2. Email Security
      3. Email Signature
      4. Email Archiving
      5. Virtual Desktop
      6. Talent Management
      7. Hybrid Cloud
    •  
      1. Virtual Desktop
      2. Talent Management
      3. Hybrid Cloud
  • Success Stories
  • Why superhub
  • Insights
    Insights
    • Our News
    • Our Events
    • Our Blogs
  • About Us
Shop Now

 

 

More from my site

  • Search an Email log using Mail GuardianSearch an Email log using Mail Guardian
  • Add Whitelist and Blacklist Domains and Email Address in Mail GuardianAdd Whitelist and Blacklist Domains and Email Address in Mail Guardian
  • Threat Spotlight: Protecting your business in 2021Threat Spotlight: Protecting your business in 2021
  • Social Engineering and Growing Complexity of AttacksSocial Engineering and Growing Complexity of Attacks
  • Microsoft is a Leader in the 2021 Forrester Wave Endpoint Security Software as a ServiceMicrosoft is a Leader in the 2021 Forrester Wave Endpoint Security Software as a Service
  • Email threat types: Domain ImpersonationEmail threat types: Domain Impersonation

Let’s #worksmarter with superhub

Empowering your business by exploring new insights with
innovative products and modern cloud solutions.

Let’s Talk
  • About Us
  • Support
  • Why superhub
  • Success Stories
  • Contact Us
  • Web Mail
  • Linkedin
  • Youtube
  • Facebook

  • Technologies
    1. Modern Workplace
    2. Security
    3. Cloud Infrastruture
    4. Business Solutions
    5. Exchange Email and Domain
  • Solutions
    1. Managed and Adoption Services
    2. Other Solutions
  • Insights
    1. Our News
    2. Our Events
    3. Our Blogs

Subscribe to our eNewsletter

Microsoft Partner Microsoft Partner

© 2023 superhub, All Rights Reserved.

  • Sitemap
  • Privacy Policy
  • Terms of Service