A security alert issued by the Federal Bureau of Investigation (FBI) signals the detection of a wave of the attack known as business email compromise (BEC) in which threat actors use social engineering, phishing and even artificial intelligence tools such as deepfake to intercept video call sessions such as Zoom and intercept bank transfers issued by affected organizations.
The Agency believes that the recent focus on videoconferencing platforms consists of a new attempt by threat actors to abuse the trend towards remote work due to the pandemic: “Between 2020 and 2021 we detected an increase in BEC complaints related to the use of videoconferencing platforms for malicious purposes,” the researchers note.
Threat actors have devised an attack by combining various malicious techniques focused specifically on video calling platforms, managing to deceive some members of organizations by posing as directors, owners or staff of financial areas for the purpose of collecting confidential financial information.
The FBI detailed some scenarios of this attack variant, including:
- Employing stolen images and deepfake audio, threat actors could pose as company directors, inviting employees to illegitimate virtual meetings to obtain transfers to hacker-controlled accounts
- Threat actors can pose as employees to simply intercept sensitive information of the affected company
- Using the stolen information, hackers can deploy phishing and social engineering campaigns for subsequent attacks
Through its Internet Crime Complaint Center (IC3), the FBI reports that these types of attacks proved very lucrative over the past two years, generating losses of approximately $1.8 billion USD, more than a quarter of the damages resulting from variant cybercrimes.
Of the nearly 800,000 complaints received by the IC3, 19,400 relate to BEC attacks, campaigns that primarily affect private organizations, although these attacks are not alien to government agencies.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
