Business Email Compromise (BEC): Tracking a Threat Actor’s Funny Business

Executive Summary

In a recent LevelBlue incident response engagement, an analyst in our managed detection and response (MDR) security operations center (SOC) responded to an alarm that was triggered by a suspicious email/inbox rule. The rule aimed to conceal responses to an internal phishing attempt from the account user, so the attacker could solicit funds from the company's users. According to a report by the Cybersecurity and Infrastructure Security Agency (CISA), “Email systems are the preferred attack vector for malicious …

account actor alarm analyst and response bec business business email compromise center compromise conceal detection detection and response email email compromise engagement executive funny incident incident response internal levelblue managed managed detection managed detection and response mdr operations phishing response security security operations security operations center soc threat threat actor tracking