Creating New Models To Combat Business Email Compromise
•
1 like•201 views
Creating New Models To Combat Business Email Compromise. We Know How to Deal with Phishing Websites There’s a Process to Deal with Malware
Recommended
Recommended
More Related Content
Similar to Creating New Models To Combat Business Email Compromise
Similar to Creating New Models To Combat Business Email Compromise (20)
More from Priyanka Aash
More from Priyanka Aash (20)
Recently uploaded
Recently uploaded (20)
Creating New Models To Combat Business Email Compromise
- 1. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary. Creating New Models To Combat Business Email Compromise Patrick Peterson, CEO & Founder November, 2020
- 2. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary. We Know How to Deal with Phishing Websites 2
- 3. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary. There’s a Process to Deal with Malware 3 • Report Binary • Analyze Binary • Update A/V signatures • Identify Command and Control • Shutdown (or Seize) C&C servers • Poison P2P C&C servers
- 4. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary.4 BEC: A Rapidly Growing Threat BEC is a million per month problem! Source: 2017 FBI IC3 Alert $139$228 Source: 2018 FBI IC3 Alert $302 Source: 2019 FinCEN Report $708 Source: 2019 FBI IC3 Alert
- 5. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary. What is Business Email Compromise (BEC) 5 Financially motivated email-based identity deception BEC uses numerous cash out methods: Wire, SWIFT, Payroll, gift card Same techniques used for information theft Email-based Domain spoofing From: Patrick Peterson Friendly Name From: Patrick Peterson Domain imitation From: Patrick Peterson Email compromise From: Patrick Peterson Email + Telephony based <chiefexcutiveoofficer@gmail.com> <ppeterson@aqari.com> <ppeterson@agari.com> <ppeterson@agari.com>
- 6. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary.6 Our First Experiment How Does the CEO Scam Work? How Can We Make the Attack Less Cost Effective?
- 7. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary. BEC Email to Agari From: Patrick Peterson To: rlim@agari.com Subject: Invoice Payment Are you in the office? Patrick Peterson Sent from my U.S. Cellular® Smartphone <chiefexcutiveoofficer@gmail.com> An “Incident” in our parlance
- 8. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary. BEC ”Baiting” Response From: Raymond Lin To: Patrick Peterson Subject: Re: Invoice Payment Yes. What do you need? Raymond <rlim@agari.com> <chiefexcutiveoofficer@gmail.com> Engaging the Fraudster
- 9. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary. Criminal Requests Wire, Reveals Valuable Asset From: Patrick Peterson To: Raymond Lim Subject: Re: Invoice Payment Process a wire transfer in the amount of $44,960 with the wire instructions below. Bank : JP Morgan Chase Bank Bank Address : 6861 Bernardo Center Drive, San Diego CA 92128-2503 Beneficiary : M*****n W****s Account Number : 86******88 Route Number : 322271627 Let me know once wire transfer is completed. Regards, Patrick Peterson A Mule Account in our parlance <chiefexcutiveoofficer@gmail.com>
- 10. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary. LATHER RINSE REPEAT
- 11. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary. Why is BEC Such a Problem? Traditional defenses focus on technical threats BEC has a higher ROI than other cyber attacks Social engineering is extremely effective
- 12. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary.12 Active Defense: A New Model to Combat BEC
- 13. © 2020 Agari. All rights reserved. Confidential and Proprietary. What if the solution was as simple as…
- 14. © 2020 Agari. All rights reserved. Confidential and Proprietary. LATHER RINSE REPEAT
- 15. © 2020 Agari. All rights reserved. Confidential and Proprietary. Manual baiting does not address the problem
- 16. © Copyright 2020 Agari. All rights reserved. Confidential and Proprietary. Active Defense Uses Low Impact Gray Zone 16 From: George Washington University Center for Cyber & Homeland Security “Into the Gray Zone: Active Defense by the Private Sector against Cyber Threats”
- 17. © 2020 Agari. All rights reserved. Confidential and Proprietary. Pick a Gang …. Any Gang…. Masterconmann London Blue Geozic Group Invisible Landlord
- 18. © 2020 Agari. All rights reserved. Confidential and Proprietary. Kelvin Utuedor aka ___ ___
- 19. © 2020 Agari. All rights reserved. Confidential and Proprietary. Why “London Blue”?
- 20. © 2020 Agari. All rights reserved. Confidential and Proprietary. Criminal Targeting Database – 50,000 Finance Executives CFO 71% Finance Director/Manager 12% Controller 9% Accounting 6% EA 2% Top Titles Targeted
- 21. © 2020 Agari. All rights reserved. Confidential and Proprietary. The leading component for BEC
- 22. • ACID: Agari Cyber Intelligence Division • Visit acid.agari.com for research reports • Email acid@agari.com to learn more • Close relationships with industry and law enforcement partners Agari develops industry-leading insights from live engagements with threat actors on behalf of customers