Background:
A renowned consumer goods company boasting annual revenue of approximately $125 million found itself ensnared by a sophisticated social engineering scam. Crafty fraudsters managed to convince the accounts payable team to transfer $750,000 into a foreign bank account. To the company's dismay, their cyber insurance policy didn't cover this type of fraud due to the lack of social engineering coverage.

Overview

1. Reconnaissance:
   Launching their deceptive plan, the attackers began by meticulously researching the organization. Utilizing the company's website, industry publications, and social media, they identified key personnel in finance and their reporting relationships. LinkedIn profiles of senior executives and accounts payable staff proved invaluable.
2. Initial Contact:
   The attackers sent a phishing email with an attachment to multiple employees. Upon opening, this attachment discreetly installed malware on the user's computer.
3. Compromise:
   With the malware in place, the attackers gained insights into internal email threads, understanding typical invoicing and payment patterns, language nuances, and vendor specifics.
4. Impersonating a Known Vendor:
   The fraudsters cleverly posed as a well-known vendor with whom the company had an established business relationship. This familiarity and trust were exploited, thereby sidestepping any typical validation processes.
5. The Deceptive Request:
   Posing as the familiar vendor, the attackers emailed the accounts payable team about an urgent and confidential foreign transaction. The request came at a time when the real CEO was away on an overseas trip, a detail the attackers gleaned from public records.
6. The Transfer:
   Given the trusted relationship with the vendor and the seemingly legitimate request, the accounts payable team promptly transferred $750,000 to the specified foreign account.

Timeline

Day 1:

• Morning:
  • Attackers begin their reconnaissance, mining the company's website, industry publications, and public profiles on platforms like LinkedIn.
  • Identification of key personnel in finance and their reporting relationships is achieved.
• Afternoon:
  • Attackers identify an employee within the accounts payable department.
  • A phishing email tailored to this specific employee is sent, masquerading as an Oiffce 365 change password notification.

Day 2:

• Morning:
  • The targeted employee opens the phishing email and unwittingly provides their email login credentials.
• Afternoon:
  • Attackers gain access to the compromised email account.
  • They start monitoring email threads, identifying vendor communications, and looking for invoice templates.

Days 3-4:

• Surveillance:
  • Continuous monitoring of the accounts payable email.
  • Attackers identify a recent invoice from a trusted vendor and download it for modification.

Day 5:

• Morning:
  • Using the downloaded invoice, attackers modify details, specifically the bank account information, making sure all other details remain authentic.
• Afternoon:
  • Posing as the trusted vendor, attackers send the modified invoice to the accounts payable department from an email address strikingly similar to the vendor's legitimate email, requesting the bank account be updated due to a change in banks.

Day 6:

• Morning:
  • The accounts payable team, trusting the invoice because of its authenticity and familiar details, initiates the payment process for the amount specified: $750,000 to the new bank account.
• Afternoon:
  • The money transfer to the attacker-specified bank account is finalized.

Days 7-17:

• Silent Phase:
  • Attackers likely move the funds around to make them harder to trace.
  • The company operates under the assumption that everything is as per routine.

Day 18:

• Morning:
  • The genuine vendor contacts the company inquiring about the pending payment.
• Afternoon:
  • Concerns arise as internal communications reveal the payment was made.
  • A review of the invoice and email headers raises suspicion.

Day 19:

• Investigation:
  • The discrepancies in the email address used by the attackers are noticed.
  • IT department and management are looped in for a thorough review.
• Late Afternoon:
  • The company realizes the depth of the scam and contacts their cyber insurance provider. The absence of coverage for such social engineering attacks in their policy is discovered.

The Aftermath:

1. The Realization:
   Seventeen business days passed before the genuine vendor contacted the company, inquiring about a missing payment. This unexpected call sounded alarm bells, leading to a closer examination of the earlier transaction.
2. Investigation:
   A detailed review of the email headers revealed the message, although seemingly from the trusted vendor, originated from an external domain. The IT department confirmed identity theft and mailbox compromise.
3. Financial Repercussions:
   By the time the scam was unearthed, the funds had vanished, having already been withdrawn or transferred by the fraudsters. An appeal to their cyber insurance provider met with disappointment, as their policy did not encompass social engineering attacks.

Lessons Learned:

1. Policy Review: Insurance policies should be comprehensive, including protection against social engineering attacks.
2. Training: Continual training is essential, particularly for finance-handling staff, emphasizing spotting and reporting suspicious activities.
3. Two-Factor Authentication & Approval: Multi-factor authentication for email accounts is crucial, as is a dual-approval mechanism for substantial transactions.
4. Regular Security Audits: Regular malware checks and software updates are imperative for precluding security breaches.

This incident underscores the ever-present need for vigilance, continuous employee training, and the regular updating of both company procedures and insurance policies. As cyber threats evolve, so must organizational defense strategies.