At NetSentries, our BEC Simulation approach is rooted in a comprehensive adversarial methodology. We orchestrate the entire campaign, beginning with crafting the campaign idea and associated infrastructure. This includes creating phishing links, tailored landing pages, and finalization of post exploitation tactics like, credential harvesting, data extraction etc. As part of this service, we create targeted campaigns against each group of employees in scope (eg, C-suite, treasury dept, etc). We then develop and discreetly deliver a custom payloads, and deliver it evading multiple levels of security solutions. Our methodology encompasses establishing a callback mechanism to a command and control (CnC) service, followed by the meticulous tracking and management of the entire campaign.
This holistic adversarial approach offers Information Security Officers (ISOs) an invaluable tool for evaluating the robustness of their email infrastructure's security controls. It also provides a means to gauge the level of general awareness within the workforce when it comes to identifying and reporting phishing links. By systematically pinpointing vulnerabilities, this methodology empowers organizations to pinpoint their weakest links and take targeted measures to enhance their cybersecurity posture.
Companies that operate across countries are a major target in this BEC scam. Criminals pretend that they are foreign suppliers to the target organization and request for fund transfers to receive the payment.
Attackers act as the CEO of the company in this attack scenario. They deliver emails to employees and ask them to perform privileged activities to suit the attackers' needs.
This attack combines tactics of both Fake invoice scheme and CEO spam. Attackers targets both individuals and organizations in this type of attacks by sending payment requests and invoices.
In this attack, cybercriminals target HR professionals and bookkeepers to get personal and sensitive data about employees.
As fake lawyers and other legal professionals, attackers rely on phones and emails to succeed in their attacks. In most cases, employees with weak awareness of proper business communications become victims of such attack.