Today on our Tech for Business podcast, we're joined by Nate, our Director of Cyber Security,
and Andrew, our Security Incident Response Team Lead.
This week, we're continuing incident scenarios and proactive measures you could take to prevent
them.
All personal information has been changed to protect confidentiality.
So, before we dive in, just first up top, is there any terminology we need so that we
can fully understand today's podcast?
And then, if there was kind of a number one thing someone can do to prevent what we're
talking about today, what that might be.
I can talk.
One of the acronyms that comes to mind is going to be BEC, Business Email Compromise.
Your logs in gets into your email.
Another one is IC3, and now I don't know the off the top of my head, so Nate, back me up.
Internet Crime and Complain Center.
That one, okay.
It's in the FBI.
Yeah, yeah, I just didn't, yeah.
Anyway, prevention.
Specifically about email compromises, two huge things you can do is MFA and use security
awareness training.
Like teaching users how to react when they maybe get a phishing email, get a document
they're not expecting.
As well as not reusing passwords, don't accept random MFA prompts, things like that.
Those are two huge things I think are very easy to implement that can give you a very
good layer of protection.
Obviously, we are changing the names and information just to protect the innocent in this, but
I think Andrew wanted to jump in maybe and share our first scenario.
Similar to our third organization from last week's podcast, this one is an actual compromise.
The user's mailbox, a wire transfer had gone out.
The attacker had gotten into a mailbox and saw that the CEO was traveling.
During that time, the CEO was in the air flying to China.
They requested a wire transfer for $283,000.
What ended up tipping it off was they came back for seconds for a second wire transfer.
The user who sent the first wire transfer asked about the original wire transfer when the
second one was going through.
The CEO was like, no, that wasn't me.
I didn't ask for any of that.
Unfortunately, they did lose $283,000.
It was a very painful learning experience.
The core outcome of that one was that when that CEO was traveling and the threat actor
knew that they were on the plane and said, I have a business deal that I need to close
up before I get home.
One of the big tip-offs here, if you ever see something like that, is that be cautious
of anything that instills some type of urgency or action on your behalf or makes you emotional
or something along those lines.
It's one of the best indicators of some type of malicious email because they're trying
to play to the emotions, which I'm not going to get into psychology or anything like that
or neuroscience.
When you start getting emotional, you tend to start cutting off that frontal lobe and
the logical nature of it, and you start acting a lot more quickly.
Threat actors intentionally play into that.
Biggest thing, just be aware if you got emotional reading an email.
Maybe not that someone's just mean, but if it's instill some type of action.
Another thing that I didn't talk about as far as the protection goes, when it comes to
wire transfers, when it comes to bank account information changes, verify in two different
ways.
Yeah, you receive an email, talk to the person in person, call them from a known phone number,
not in the email, but somewhere like you had them on speed dial, you had them in your
Rolodex, whatever.
Contact them in a separate way outside of that email.
CIT, what we do is if a person has to change their bank account information, JSA, they change
banks.
We send their paycheck through the snail mail.
So then the user has a paper check in their mailbox.
It's kind of an immediate tip off that maybe I didn't request this, and then things can
be changed.
What you said, Rolodex, I was thinking of the old Palm pilots, with the little stylus.
Even older, the ones that you turned.
Yeah.
Kind of org five, just a second incident where we had an email compromise, someone sat in
the mailbox for quite some time.
Similar to last week when we talked about they can sometimes sit there for weeks or months,
just waiting for the perfect opportunity to capture some type of desirable wire transfer.
We had another organization that called us saying, I'm really concerned.
Actually last week I talked about we've had people crying on the phone.
This was one of the business owners.
He called and legit crying because he just lost $528,000 due to a fraudulent wire transfer.
It's devastating to hear someone going through that stress, but being able to say, well,
at least start taking the proper actions to help you out.
Now, CIT, we can't guarantee you'll get those funds.
They've already been sent off.
Now that's up to the banks and the government and everything like that to help you out.
But we helped them navigate the federal reporting.
When Andrew had mentioned the IC3 or Internet Crime and Complaint Center, that is the FDA's
division to report some type of cyber crime.
They don't always get back to you, right, sometimes if it's a very, very minimal thing,
like I got compromised on my email, you probably never will hear from it.
In this case, because it was over $500,000 and it was to a different nation, the FBI
was really engaged in that one and reached out and started working with them.
Where was the wire transfer sent?
What's your bank account info?
Everything like that.
They were actually able to stop that fund while I was traveling through some Canadian
banks over to China and they actually received all that money back.
My biggest takeaway there is even though it was processed, there is a chance you may still
get it back.
Now, there's no guarantees, right?
We heard in the last example from Andrew that they didn't get that back.
They lost a quarter of a million dollars.
In this case, they got the half a million dollars back, but it required federal intervention
and at that point, I'm assuming multiple nations to be able to coordinate that between all
the different banks.
As you're talking about that, I do want to add a little bonus one.
Maybe this is more of a close call, but it would have been a successful wire transfer.
I don't remember all the details of it, but let me step back a little bit.
When a wire transfer goes through the attackers, they will normally, it's to an account that
they have control of, then they're going to hop it multiple times to multiple different
banks all around the world, so it makes it impossible to pull it back.
Then the last hop transfers to Bitcoin and it's gone.
The attacker in this bonus close call, I guess, they had mistyped the bank account information
by one digit.
I think it's like $40,000 or something like that, but that one single mistype froze the
funds because it was an incorrect bank account.
People did get the money back, but it was the attacker mistyping which saved them.
Human error, man.
Human error never happens, right?
Yeah.
Wow.
I feel like this month is all about, you know, September.
We got some scary stories going on, but most important, so what do we do as a business?
What are the key takeaways from this week's information?
What do we set up so that we're not in this situation?
Then a second part is, if this happens, why it might be important to slow down?
I think people speed through a situation like this if it's happening to them.
I think the first thing that comes to mind, so one of the best words of advice I've ever
had for how do you best protect a network?
It's focusing on where the prevention failures have happened in the past.
When you take a look at both of these successful wire transfer attempts, they both failed because
there was an account compromise in their email first.
The first prevention failure is that the employee fell for a phishing email and gave up their
credentials.
That means that there's additional employee training that has to happen in that environment.
The second prevention failure was that I believe in both of these cases, they didn't have a
multi-factor enabled.
I don't remember about the other one with the mistype on the wire transfer, but I believe
in two of the cases, they didn't have a multi-factor.
Even if they did, they still maybe accepted that multi-factor push to still allow someone
in.
Regardless, someone had to make their way into that mailbox to start monitoring those
activities and wire transfer requests.
That's the biggest thing was multi-factor, multi-factor, multi-factor.
I literally have glasses that say multi-factor everything.
It's that important.
And then, Andrew, you kind of mentioned it before about the verifying wire transfers,
but I don't know if you want to reiterate anything else there.
If something doesn't sit right, question it.
CEO says, hey, I can't talk right now.
Can you please do this?
Verify it.
Nothing is going to be needed in the next two minutes that you can't maybe ask a question
of one of your coworkers or ask maybe the CEO secretary.
Just ask questions if something doesn't feel right because it's worth the extra time to
verify who you're talking to or verify the legitimacy before you complete a request.
That's, as Nate had mentioned before, the attackers bring in the emotional urgency.
I need this now.
My cat died, whatever.
Make you feel good, feel bad, whatever.
So if something doesn't sit right, verify it.
I just thought of one thing.
This also comes in multiple flavors.
So we keep talking about just business to business, wire transfer attempts.
If you're an HR individual, one of the most common things that we see here is someone's
spoofing one of your employees, emailing HR and saying, I want to change my payroll
to a new bank account, and HR not validating that that employee actually wants to change
their bank account.
Sometimes they just go, yep, it looks like it came from their email, but it was spoofed
from some other email address.
And then they just go in and process it and all of a sudden the employee says, well, where's
my paycheck?
And then they start finding out.
So it doesn't just have to be banked or business to business transfers.
It can be internal.
So if you are an HR payroll, be very careful with those ones as well.
Thanks to Nate and Andrew for joining us this week.
If you enjoyed this podcast, please like and subscribe.
If you have a question or topic you'd like us to discuss, reach out to us at info at
cIT-net.com or head out to our website cIT-net.com slash podcast.
And we'll be back next week with more incident scenarios.