SC-015: Business Email Compromise (BEC) Deep Dive¶

Threat Actor Profile¶

CRIMSON LEDGER is a West African cybercrime syndicate active since 2019, specializing in vendor email compromise (VEC) — a sophisticated variant of Business Email Compromise where the attacker compromises a trusted vendor's email infrastructure rather than the target organization directly. This approach bypasses traditional BEC detection because the phishing emails originate from legitimate, trusted domains with valid DKIM signatures.

The group targets procurement and accounts payable departments at enterprises with annual revenue between $500M and $10B. Their average campaign yield is $1.2M–$4.5M per successful operation. They demonstrate exceptional patience — maintaining access to compromised vendor mailboxes for 30–90 days before executing the fraud, meticulously studying invoicing patterns, approval workflows, and banking relationships.

Motivation: Financial — invoice fraud via wire redirection, typically laundered through money mule networks across Eastern Europe and Southeast Asia.

Scenario Narrative¶

Phase 1 — Reconnaissance & Vendor Compromise (~25 min)¶

CRIMSON LEDGER identifies GlobalCorp as a target through LinkedIn reconnaissance and publicly filed SEC procurement disclosures. They map GlobalCorp's top 20 vendors using open-source intelligence — press releases, LinkedIn posts by procurement staff, and Dun & Bradstreet data. They identify Meridian Industrial Supply as a high-value, high-frequency vendor with a predictable monthly invoicing cycle of $200K–$400K.

The attacker sends a spearphishing email to j.williams@meridian-supply.com (Accounts Receivable Manager at Meridian) containing a malicious PDF disguised as a purchase order from another Meridian customer. The PDF exploits a known vulnerability in the Meridian employee's unpatched PDF reader, dropping a credential-harvesting implant. Within 48 hours, CRIMSON LEDGER has j.williams's O365 credentials and establishes persistent access via an OAuth app with Mail.ReadWrite and Mail.Send permissions.

For the next 45 days, the attacker silently monitors Meridian's mailbox, cataloging every invoice sent to GlobalCorp — noting invoice formats, numbering conventions, payment terms, authorized signatories, and banking details.

Evidence Artifacts:

Phase 2 — Invoice Manipulation & Email Interception (~30 min)¶

On 2026-01-15, Meridian sends GlobalCorp a legitimate invoice (#MIS-2026-0142) for $387,500 for Q1 industrial equipment deliveries. The email is sent from j.williams@meridian-supply.com to p.nakamura@globalcorp.com (Procurement Manager) and ap-team@globalcorp.com.

CRIMSON LEDGER intercepts this email in j.williams's Sent Items within 3 minutes. The attacker creates an inbox rule in the Meridian mailbox that redirects all replies from @globalcorp.com to a hidden folder, preventing the real Meridian AR team from seeing GlobalCorp's responses.

Within 2 hours, the attacker sends a follow-up email from j.williams's legitimate mailbox to GlobalCorp:

"Hi Priya, following up on invoice MIS-2026-0142 — we've recently changed our banking partner. Please update our payment details to the attached new bank verification letter. Going forward, all payments should be directed to the updated account."

The attached "bank verification letter" is a convincing forgery on Meridian letterhead (obtained from previous invoices), directing payments to a fraudulent account at a Lithuanian bank: IBAN LT603250012345678901.

Evidence Artifacts:

Phase 3 — Wire Fraud Execution (~25 min)¶

GlobalCorp's accounts payable coordinator, Daniel Okonkwo, processes the banking detail change. He updates Meridian's payment record in the ERP system (SAP) with the new Lithuanian IBAN. The change is approved by Priya Nakamura, who recalls the email from "j.williams" but does not perform a callback verification — she's processing 47 invoices that day and the email came from a known, trusted sender.

On 2026-01-22, the weekly payment batch runs. Three payments totaling $1,247,800 are wired to the fraudulent IBAN:

The funds arrive at the Lithuanian bank at 14:32 UTC. By 15:10 UTC, $890,000 has been transferred to a secondary account in Hong Kong. The remaining $357,800 is moved to a cryptocurrency exchange and converted to Monero within 6 hours.

Evidence Artifacts:

Phase 4 — Detection, Containment & Notification (~30 min)¶

On 2026-01-28, the real Meridian Industrial Supply contacts GlobalCorp asking about three overdue invoices totaling $1,247,800 that were due on January 22. Priya Nakamura confirms the payments were sent — to the IBAN Meridian provided in their January 15 email. Meridian denies sending any banking change notification. The fraud is confirmed.

GlobalCorp's security team launches an investigation. They discover:

Evidence Artifacts:

Detection Opportunities¶

BEC Prevention Checklist¶

Key Discussion Questions¶

1. Your email gateway correctly authenticated the fraudulent email (SPF/DKIM/DMARC all passed). Does this mean email authentication is useless against BEC? What does it protect against, and what gap remains?
2. The callback verification policy existed but wasn't consistently enforced. What organizational and technical controls would you implement to make this a hard control rather than a soft one?
3. The attacker maintained access to the vendor mailbox for 45 days before executing the fraud. What vendor risk management practices would help detect a compromised vendor earlier?
4. Of the $1,247,800 lost, only $357,800 is potentially recoverable. What factors determine wire fraud recovery success, and how would you optimize your organization's response time?
5. The attacker used residential proxies in Nigeria. How useful is IP geolocation as a detection mechanism for BEC, given the prevalence of VPNs and residential proxy services?

Debrief Guide¶

What Went Well¶

• Email authentication (SPF/DKIM/DMARC) was properly configured on GlobalCorp's domain — the gap was in vendor-side monitoring
• SAP ERP maintained a complete audit trail of vendor master changes — forensic reconstruction was possible
• FBI IC3 and law enforcement coordination resulted in partial fund freeze ($357,800)

Key Learning Points¶

• Vendor email compromise bypasses email authentication — because the emails come from the legitimate vendor domain, traditional SPF/DKIM/DMARC checks pass
• Callback verification is the single most effective BEC control — but only if enforced consistently as a hard control, not a checkbox
• 45-day dwell time in vendor mailbox — attackers invest weeks studying invoicing patterns before executing fraud
• Wire fraud recovery is time-critical — success rate drops from ~29% (within 24 hours) to near-zero after 72 hours
• BEC is a process failure, not a technology failure — the attack succeeded because of inconsistent control enforcement

Recommended Follow-Up¶

• [ ] Implement mandatory callback verification for all vendor banking changes — integrate into ERP workflow as a blocking control
• [ ] Deploy AI-based email security that detects behavioral anomalies in vendor communications
• [ ] Establish vendor risk management program — require key vendors to demonstrate email security controls
• [ ] Integrate SAP vendor master change alerts into SIEM for real-time monitoring
• [ ] Conduct quarterly BEC simulation exercises for accounts payable staff
• [ ] Review cyber insurance policy for BEC/wire fraud coverage limits and notification requirements
• [ ] Implement 48-hour payment hold for all transactions to newly modified banking details

References¶

• Chapter 14: Email Security & Phishing Defense
• Chapter 9: Incident Response Lifecycle
• Chapter 7: Threat Intelligence & Context
• Chapter 22: Fraud Investigation & Financial Crime