Business Email Compromise attacks are one of the fastest-growing and most difficult-to-stop attacks in the cybersecurity space. There are a number of variants, but in general, these attacks spoof someone in your organization, often an executive, and don’t use any malware or malicious links. (BEC attacks can also involve malware or malicious links, but the toughest ones to stop are primarily text-based.)
These attacks have led to significant financial losses, primarily because they seem real. Think about it from an end-user perspective. If you get an email from your “CEO” asking you to pay an invoice, or worse money to a customer, do you say no? That’s what hackers are hoping for.
In this BEC attack, we’ve seen hackers get even more creative.
In this attack brief, researchers at Avanan, a Check Point Software Company, will discuss how threat actors are using the legitimacy of Evernote to help make their BEC attacks even more convincing.
Attack
In this attack, hackers are using Evernote links to host malicious messages that are sent in Business Email Compromise attacks
Email Example #1
This starts as an attached message, sent directly from the president of the organization in question. This is a compromised account. Hackers will often spoof executives using trickery in the sender field; in this case, the president of the organization was actually compromised, and thus is sent directly from that person’s account.
The attached message leads to an email saying there’s a “secure message.’ The link goes to an Evernote page.
The Evernote page has since been taken down. But Evernote, like many legitimate websites, is being increasingly used for hacking. Recently, according to Huntress, there’s been an uptick in hosting malicious documents on Evernote.
In this case, there’s a document on Evernote that leads to a fake login page to steal credentials.
Techniques
Business Email Compromise attacks are tough to stop from a security perspective, and tough to recognize from an end-user perspective. This attack is a hallmark of that difficulty.
It starts with an email from the President of an organization. The account was compromised, so the email will pass all authentication measures. The message itself is not malicious. It links to a document in Evernote–not a malicious site.
From a security perspective, this looks clean. If you’re an end-user, it looks clean. Using a legitimate site like Evernote–particularly if Evernote is already used in that organization–adds a ton of credence.
In short, it’s an incredibly well-crafted attack.
Stopping BEC attacks, then, becomes incredibly important, and there are a few things that need to be done. For one, AI and ML need to be involved. There needs to be the ability to understand the content of an email, the context and the tone, and understanding when that differs. For example, does the president of the organization typically send links to Evernote?
From there, the organization has to be able to re-write and detect malicious links and attachments. Evernote is not malicious; the document included is. Can the security service follow that link and attachment all the way through to the credential harvesting page, understanding if it is indeed malicious?
And, does the organization have account takeover protection? We don’t know how this user was initially compromised, but today’s world provides the hacker plenty of ways to do it–email, text, voice, chat, and file-sharing. Understanding login events, configuration changes and end-user activities throughout the entire productivity suite is key.
Best Practices: Guidance and Recommendations
To guard against these attacks, security professionals can do the following: