In a sophisticated business email compromise (BEC) attack recently uncovered by Trend Micro Managed XDR team, threat actors exploited a compromised third-party email server to conduct fraudulent financial transactions between business partners. Rather than simply sending fraudulent emails, the threat actors patiently inserted themselves into legitimate email threads between business partners, gradually replacing recipient addresses with their own controlled accounts while maintaining the appearance of normal communication. While the security analysts at Trend Micro noted that the attackers continued manipulating the conversation over several days, eventually causing Partner B to deposit funds into the threat actor’s account instead of Partner A’s legitimate account. The scheme, which unfolded over several days, involved manipulating email conversations between three business partners, ultimately leading to funds being transferred to accounts controlled by the attackers. What makes this attack particularly concerning is how the threat actors maintained two separate conversations – one with each legitimate partner – while neither partner realized they were communicating with the attackers rather than each other. The precise technical mechanism involved a compromised email server with insecure configurations that allowed emails to pass Sender Policy Framework (SPF) authentication despite not originating from authorized domains. Security experts recommend implementing proper DMARC enforcement, DKIM email signing, and establishing out-of-band verification protocols for financial transactions. The attack began when the threat actor intercepted an email reminder about an invoice sent from Partner A to Partner B. The threat actor initially inserted themselves into the email chain, after this they eventually took complete control of the conversation by separating the legitimate partners. Multi-factor authentication, digital signatures for emails containing financial instructions, and verification protocols between business partners remain essential defenses against these increasingly sophisticated BEC attacks. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 10 Mar 2025 05:55:13 +0000