Information about Adlumin’s free Business Email Compromise Attack Simulator Tool and relevant industry news.

ElevateIT Phoenix Technology Summit 2024

ElevateIT provides a one-stop, all-inclusive experience which brings IT & IS practitioners together with experts and thought leaders throughout the country.

This premier conference brings together technology leaders, professionals, and enthusiasts to discuss emerging trends, best practices, and innovative solutions across various topics including cloud computing, cybersecurity, data analytics, and more. With engaging keynotes, panel discussions, interactive sessions, and networking opportunities, attendees can connect with industry experts, gain valuable insights, and explore the latest technology solutions and services from leading vendors.

Whether you’re a technology leader, professional, or enthusiast, this summit offers a chance to stay informed and enhance skills in the ever-evolving tech landscape.

Date: March 13, 2024
Location: Phoenix Convention Center, Phoenix, AZ
Booth: #501
Sponsorship Level: Breakout / Conference Exhibitors Sponsor

Speaking Session

Lessons Learned for Securing M365

Speaker: Jordan Gackowski, Senior Systems Engineer at Adlumin
Date: March 13, 2024
Time: 11 AM – 12 PM
Location: Tech Theater 3

Jordan works with customers every day to help monitor and secure their environments. Approximately 80% of his customers use M365, Hybrid, or some variation of those. In this talk, he will highlight and discuss some best practices and common configuration errors seen on a daily basis and help you address some potential risks to securing your M365 environment. If you don’t use M365, that’s ok! These concepts also apply to other platforms like Google Workspace and others.

Contact: marketingevents@adlumin.com

Business Email Compromise Warning Signs and Defense

By: Brittany Demendi, Corporate Communications Manager

According to recent FBI warnings, Business Email Compromise (BEC) scams are rising for organizations in the United States, naming them the $43 billion scam in 2022. Cybercriminals use these scams to ruthlessly target small to medium-sized businesses by researching and posing as vendors or employees attempting to siphon money. BEC scams do not require much sophistication, making them simple yet effective.  

This blog identifies how a BEC scam works and how an organization can better protect itself before falling victim.   

How Does a BEC Attack Work? 

Cybercrime is an evolving game, and cybercriminals adjust their strategies and tactics as security increases. BEC attacks don’t need a tradecraft or advanced tool to execute so they can be presented in many forms. Here is how a typical attack can operate and run its course: 

Research Target 

Launch Attack OR Social Engineering 

Winner, Winner 

  • Research Target: Cybercriminals research and prepare for an attack by sifting through business email databases, mining LinkedIn profiles, or even searching company websites for information. They then carefully craft an email to the targets.  
  • Launch Attack Option 1 – Phishing: Cybercriminals start their BEC attacks by sending out mass emails to see whom they can catch. During this phase, they use fake email names and look-alike domains to trick employees into thinking it’s a legitimate email and ultimately get them to click the link.  
  • Launch Attack Option 2 – Social Engineering: Cybercriminals impersonate employees, specifically CEOs, attorneys, or vendors, to build trust with the target. They typically ask for an urgent request so that the employee will act immediately.  
  • Winner, Winner: Cybercriminals make a financial gain or obtain account compromise. The cybercriminal successfully fooled the employee into believing that they were someone else.  

How to Prevent a BEC Attack 

Cybercriminals leave breadcrumbs before an actual attack occurs. In 2022, the average time to identify and contain an attack was 277 days. When you break it down, it took 207 days to identify the breach and an additional 70 days to contain it, according to IBM Report. If we can identify and contain breaches early, for example, in Phase 2, we can mitigate the financial damage and loss to an organization. The goal is to incorporate security awareness into every department, making it a part of the company culture and continuously testing the strength of your security.  

Security Culture and Human Intelligence   

Many account compromises, data breaches, and ransomware attacks could have been avoided. As an organization, you can take as many preventative measures and precautions as possible to mitigate the risk of an attack, and all it will take is a simple human error to put you at risk.  

The good news is that there are measures organizations can take, such as implementing robust, Proactive Security Awareness Training. These programs empower employees to identify and report suspicious activity as the first line of defense during Phase 2 of an attack. It’s essential that training is not one-off sessions. The program is more efficient when it is consistent training that facilitates a positive cybersecurity culture, along with testing employees’ knowledge, so they are better prepared for when an actual BEC attack occurs.  

The type of culture built at your organization directly impacts your success. For more tips, in a previous blog post, we outlined different ways to create a culture focused on security.   

Test Your Security Strength and Protection 

In addition to equipping employees with the proper knowledge, consistently testing your defenses is another proactive solution. Specifically, testing the Microsoft 365 (M365) environment will not only identify where gaps are in your protection, but it will test how your security stacks up to top tactics used to compromise accounts. Millions of organizations use M365, making it a popular target for cybercriminals mainly due to the amount of data and information they have access to when successfully compromising an account.  

Security teams often lack the proper resources to identify risk areas and test their security programs. However, the free tool, M365 BEC Simulation Tool, allows organizations to test different scenarios that can compromise accounts on their security defense. The tool will also test to see how protected they are and are a huge help against BEC and ransomware attacks.  

The free M365 BEC Simulation Tool can be highly beneficial because it tests the most common attacks cybercriminals use, such as brute force attack-to-success, logins using Tor to breach an account, and a successful login from a foreign country. In a recent blog post, we go into detail about how each one of these tactics works and what your proactive solution is against them.   

The Proactive Approach

BEC attacks are low-risk, high-reward ways cybercriminals take advantage of employees and the security gaps within an organization’s defense. With smaller businesses being the number one target for BEC scams, cybercriminals know they typically have lower budgets for security. A light at the end of the tunnel, and free tools are available to you.  

In addition, Managed Detection and Response Security Operation platforms and Managed Detection and Response (MDR) services are an extension of your security team by delivering top talent and expertise for a cost-effective rate. BEC attacks are rapidly growing and are the most financially damaging. What are you going to do to mitigate the risk?  

Test Your Defenses: New Adlumin M365 Tool

By: Shaul Saitowitz, Data Scientist at Adlumin

Test Your Defenses – For Free

Adlumin developed a free tool that measures how organizations’ security stacks up against today’s most popular cyberattack tactics against Microsoft. Conceived by Adlumin’s cofounder and CEO, Robert Johnston, the Microsoft 365 (M365) Business Email Simulator (BEC) tool is the first of a Test Your Defenses tool series slated for the 2023 rollout.

Adlumin’s M365 BEC Simulator tool allows organizations of all sizes to test their defenses against a brute force attack-to-success on a Microsoft 365 account, login from a foreign country, and Tor usage to access your network from a randomized location. The simulation is a quick but effective test of how well your systems are being monitored. Don’t turn a blind eye to threats lurking in plain sight.

This blog will dive into the three main attack tactics cybercriminals use to access your account and how Adlumin’s M365 BEC Simulator free tool can help you see where your security gaps are.

Tactic 1: Logins Using Tor to Breach an Account

The Tor network is system cybercriminals use to facilitate anonymous communication by hiding their Internet Protocol (IP) address through private connections and encryption. There can be some legitimate users within the Tor network; however, it can also be overwhelmingly malicious due to the network’s ability to act as a smokescreen to obscure and anonymize web activity.

Cybercriminals utilize the Tor network because it covers their tracks by directing internet traffic through thousands of relay nodes. If someone is using Tor to access your network, you want to know about it. Adlumin’s M365 BEC Simulator tool tests this type of attack to see if your security holds up against it, so you can further investigate.

Tactic 2: Brute Force Attacks-to-Success

Brute force attacks are a common way for attackers to gain access to a system using a high-volume guessing of passwords until they get lucky. Adlumin’s investigation and research show automated brute force attempts are common for any login exposed to the internet. This includes services that aren’t configured, such as Microsoft Exchange Online. The potential rewards of brute force attacks are huge because a cybercriminal gains access to your account that may host confidential information or data.

The new M365 BEC Simulator tool tests a successful brute force attack to see how your security is against it.

In addition, Multi-Factor Authentication (MFA) malfunctions are a related threat and need to be reported to ensure the assessment of second-line defenses. For example, Adlumin reports MFA failure for Okta and Cisco Duo clients through a Data Science logic for identifying suspicious incidents. Even with such alerting, routine testing is required to ensure breaches don’t go unnoticed, allowing time for a hacker to explore your file system.

Tactic 3: Foreign Country Logins

Most cyberattacks come from unidentified cybercriminals or groups from all over the world. That said, most cybercriminals don’t just target individuals or organizations in their native country. Some of the most successful account logins come from unusual locations that the user is clearly not at. When your organization gets hit from an area where none of your employees work, your accounts and data are no longer safe.

The Adlumin M365 BEC Simulator tool takes care of the many tricky details of simulating such intrusion, allowing you to stress-test logins from distant shores without spending on air tickets, whether from a Mumbai high-rise or a train station in DĂĽsseldorf.

Does Your Security Measure Up?

See how your security stacks up against top tactics used to compromise accounts. Download Adlumin’s free M365 BEC Simulation tool today, or contact one of our cybersecurity experts for a demo and more information.

Battling Business Email Compromise with Cybersecurity Automation

By: Brittany Demendi, Corporate Communications Manager

According to Security Magazine, there has been a 150% year-over-year increase in Business Email Compromise (BEC) attacks, making them the most financially damaging type of attack. When this threat is getting worse every year, it’s no surprise the FBI named BEC the “$26 billion scam.”

So, what exactly is a BEC scam, and how do we protect against them?

This blog will dive into the details of these attacks, covering how an attack works to your defense against them.

What is Business Email Compromise?

BEC is a cybercriminal phenomenon with a high risk of severe consequences. These attacks are more likely to rise, both in frequency and losses to organizations, big or small, that fall victim. BEC is a common scam where cybercriminals pose as vendors or company employees attempting to commit wire transfer fraud, among other tactics.

The FBI reported nearly $2.4 billion in adjusted losses due to BEC scams, which is reported as 49x as much as ransomware losses in 2021. These scams are simple yet effective and have become more sophisticated as prevention methods are implemented. For example, cybercriminals use a common form of phishing called domain spoofing, where they fake a website or email domain to fool the target into clicking or responding.

BEC has been known as a low-risk, high-reward way to siphon money from organizations. The FBI calls out five primary types of BEC attacks to be aware of:

  • Data Theft: Cybercriminals target human resource employees to obtain personal and confidential information about individuals within the organization, specifically executives. Cybercriminals use this information as leverage or to impersonate someone for future attacks.
  • Account Compromise: Cybercriminals gain access to an employee’s email account and use it to request money from vendors. Payments are sent to bank accounts controlled by cybercriminals.
  • Attorney Impersonation: Cybercriminals often impersonate legal representatives or lawyers over the phone. Lower-level or entry-level employees are targets for these attacks due to not knowing to question the authenticity of the request.
  • CEO Fraud: Cybercriminals position themselves as an executive or CEO of a company. Posing as a CEO, cybercriminals typically target an employee within the finance or accounting department, requesting funds to be transferred to an account controlled by the cybercriminal. Or they request sensitive information.
  • False Invoice Scheme: Cybercriminals target organizations that use foreign suppliers are the main target of this tactic. The cybercriminal impersonates the supplier requesting payments or fund transfers into an account controlled by the cybercriminals.

Techniques for Business Email Compromise: Phishing

As we have touched on in a previous blog post, phishing is an early-stage and reliable tactic used by cybercriminals to gain access to networks as a part of a more powerful attack. In other words, phishing can be used as a technique or vessel for BEC.

An example of phishing as a BEC technique is as simple as receiving an email from your IT department asking you to update your password or complete a security awareness training module. You then click the links provided in the email, not noticing the extra letter in the company email domain or the unusual URL provided.

Cybercriminals commonly use techniques like the above phishing email example to lure a potential victim into performing dangerous actions that put organizational data at risk, costing an organization a significant amount of money.

Illuminating Threats

BEC scams can be highly transactional; cybercriminals do their research targeting large corporations’ email accounts and employees who use email for daily financial transactions. From global corporations to medium and small businesses, everyone is vulnerable to BEC.

There is not one type of software or solution that can combat BEC. A suggested approach is multifaceted and multilayered, including a strategic combination of implementing cybersecurity awareness training, business email compromise simulators, behavior analytics, and multi-factor authentication.

When security teams often lack the proper resources to test their security programs, they need a tool to understand their organization’s risk to the current and evolving threats. A BEC simulator tool tests prevalent attacks while identifying areas of risk. When paired with Proactive Security Awareness, employees gain awareness and are empowered with the knowledge and skills to identify suspicious activity. While BEC simulators are testing the strength of security tools, Proactive Security Awareness uses real-life de-weaponized attack campaigns holding every employee accountable for their actions without damage to the organization.

Your Defense: Automation

BEC scams require a people-centric and automated defense that can detect, prevent, and respond to a wide range of BEC scams and phishing techniques. Automation is about leveling the playing field between cybercriminals and cybersecurity experts with the goal in mind of reducing the number of threats by eliminating vulnerabilities and risk through the prevention of identification of zero-day attacks and known cyber threats.

An automated cybersecurity solution, combined with cybersecurity experts, eliminates human error, increases agility, and reduces response time and remediation costs. In addition, security and behavior analytics assist with tracking users to ensure that an employee signing into a network is legitimate.

Email is the largest infection vector for transmitting threats, requiring a reliable solution to remain resilient. Domain authentication, email security, user awareness, and content inspectors must work together to provide the utmost protection.