Bec attacks, the new frontier for cybercriminals is corporate email scams

Historically Bec attackswhich in many cases originate in West African countries and especially Nigeria, are less technically advanced and rely more on social engineering, or the practice of creating stories that can deceive victims and induce them to take actions that go against their own interests. However, Hassold points out that many malware used in ransomware attacks are designed to be flexible and modular, so that cybercriminals can assemble the tools they need for a specific scam. The technical skill required to gain “initial access” and then deploy additional malware would also be extremely useful for BEC attacks, in most of which accessing strategic email accounts is the first step. Ransomware-savvy cybercriminals would add a much higher level of sophistication to this aspect of scams.

Hassold further explains that, while the most famous and aggressive ransomware gangs are generally made up of small groups, the actors involved in Bec attacks are usually organized into much less structured and more decentralized collectives, which makes it more difficult for law enforcement to target a central organization or boss. Similar to Russia’s reluctance to cooperate in ransomware investigations, global law enforcement also needed time to develop working relationships with the Nigerian government in order to counter the BEC attacks. But despite Nigeria’s efforts, to limit the extent of these operations remains a difficult task.

“You can’t cut off the snake’s head – argues Hassold -: even by arresting a dozen or even a few hundred of these actors, the situation does not change much“.

The collection of money and possible developments

For ransomware gangs, the most difficult aspect of the transition to Bec scams would probably lie in the big difference in the methods of collecting the stolen money. Attackers who rely on ransomware get paid by their victims almost exclusively in cryptocurrencieswhile the criminals who launch attacks Bec mainly use local networks from money mules [ovvero i soggetti reclutati per effettuare riciclaggio o trasferimento di soldi, ndr] in the markets where they launch their scams. To monetize Bec scams, ransomware actors would need to connect to existing networks or invest to create new ones, and have a place to merge payments. Hassold points out, however, that now that law enforcement is becoming increasingly proficient in the track and block cryptocurrency paymentsand that their value continues to undergo enormous fluctuations and real collapses, the gangs of ransomware could be pushed to learn new techniques and to change sector.

Although Hassold and his colleagues found no evidence of active collaboration between Eastern European ransomware gangs and West African BEC organizations, some clues found by the researcher in forums frequented by cybercriminals and in the course of his work show that ransomware gangs are interested in Bec attacks and are learning the technique.

“All of these types of attacks are very serious and the stakes are very high. I wonder what things will be like in the future when ransomware is curtailed – says Hassold -. It is possible that these two threats, which are on opposite sides of the cybercrime spectrum, converge in the future: we must be ready “.

This article originally appeared on Wired US