Major BEC Phishing Ring Cracked Open with 3 Arrests

[silversurfer]

Three men suspected of participating in a massive business email compromise (BEC) ring have been arrested in Lagos, Nigeria.

A joint INTERPOL, Group-IB and Nigeria Police Force cybercrime investigation resulted in the arrest of the Nigerian nationals, believed to be responsible for distributing malware, carrying out phishing campaigns and extensive scams worldwide.

In a BEC attack, a scammer impersonates a company executive or other trusted party, and tries to trick an employee responsible for payments or other financial transactions into wiring money to a bogus account. Attackers usually conduct a fair amount of recon work, studying executive styles and uncovering the organization’s vendors, billing system practices and other information to help mount a convincing attack.
 
The elements of this particular campaign are myriad, according to INTERPOL: The suspects are alleged to have developed phishing links and domains, then carrying out mass-emailing campaigns where they impersonated employees at various organizations.
 
Upon successful social-engineering efforts, they then spread 26 distinct malware variants to victims, including spyware and remote access trojans (RATs), according to law enforcement. The samples included AgentTesla, Loki, Azorult, Spartan and the nanocore and Remcos RATs.
 
While investigations are still ongoing, some 50,000 targeted victims have been identified so far.
“These programs were used to infiltrate and monitor the systems of victim organizations and individuals, before launching scams and siphoning funds,” according to INTERPOL, in a Wednesday announcement. “According to Group-IB, the prolific gang is believed to have compromised government and private-sector companies in more than 150 countries since 2017.”

Read more: https://threatpost.com/bec-phishing-ring...ts/161616/