Fighting Business
Email Compromisewith Kaspersky
Security forMicrosoft Office 365

What is BEC?
Business Email Compromise (BEC) is a form of phishing where scammers attempt to convince their
victim to transfer money to the attackers’ accounts by posing as some sort of authorized representative.
Important sensitive data can be obtained in this way, in addition to conducting simple financial fraud, andthe goal may be to cause reputational damage to the organization under attack.
Organizations around the world arefalling victim to this type of financialfraud. In 2019, as a result of a BECattack, St. Ambrose Catholic Parish in
Brunswick (USA, Ohio) lost $1.75 million
from church funds. And at the end of
2019/start of 2020, the government ofPuerto Rico lost approximately $5 million
as a result of a series of such email
phishing attacks.

In a BEC attack, the attacker relies on the victim not being too attentive, and uses adomain or sender name in the ‘From’ field extremely similar to one the victim would befamiliar with.

Building comprehensive security in the contemporary threat landscape is impossible
without effective Endpoint Detection and Response (EDR), offering security managers
a real-time view of any threat, no matter how complex. EDR provides such essential
capabilities as deep visibility and the ability to reveal the true scope and root cause ofthreats, as well as instant automatic response across all endpoints. A vendor on yourshort list must demonstrate these EDR capabilities as well as ways to increase security
efficiency with automation, simple controls and deployment.

1This type of threat is called Internal BEC:
an attack that occurs from one or more of theorganization’s internal addresses.
Why are Internal BEC attacks sodangerous?
Unlike ordinary BEC attacks, which rely on the recipient’s inattention or lack of email
authentication checks, Internal BEC attacks are indistinguishable from any normal
message from a company employee in terms of their ‘technical’ details.
Because the attacker’s address is genuine, and the request to transfer money orprovide information is framed as something pressing and urgent, an unsuspecting
recipient is likely to fall for the scam and fulfil the attacker’s demands.
Scammers can also use fake (phishing) sites in Internal BEC attacks, using an address
which may differ from that of the attacked organization by just one or two letters - easily
overlooked. For example, a scammer might replace a lowercase L(‘l’) with a capital i (‘I’),
which is completely indistinguishable to the naked eye. Such a phishing site may contain apayment form, or a survey used to obtain confidential information, for example.
In these cases, the attacker doesn’t need to conduct a long correspondence with thevictim to persuade them to transfer the required amount to their bank account, or toprovide sensitive information - they simply insert a link to the fake website in their message.

Protection against Internal BEC
threats in Kaspersky Security
for Office 365
Kaspersky researchers are constantly working to improve the protection of email traffic
from the most complex threats, including Internal BEC. The main focus is on email content,
given that the technical headers of a malicious Internal BEC email will be the same as thoseof a genuine email from that colleague or department.
Millions of spam messages enter our email traps from around the world every day. To isolate
messages from this stream, and subsequently the text that contains signs of fraud, we use
a complete ensemble of machine learning classifiers.

2Spam stream

Text classifier

Term building

Heuritics

In order to learn how to work with the text, we use a language model that is based on AWDLSTM architecture (Average-Stochastic Gradient Descent (SGD) Weight-Dropped LSTM),
which is a recurrent neural network. This model is trained using a very large number of texts
obtained from open sources in a specific language. After the model has been trained, wecan begin to reuse it for text classification (transfer learning). The classifier, in turn, is trainedusing a very small amount of data. To explain how this works, let’s draw an analogy withhuman learning. Having read a lot of books in English and gradually learnt the language, weare then shown the phrase “Roses are red” and have to choose the corresponding phrasefrom the examples below:• “Violets are blue”• “Work is over”• “Green Card”
As we understand that the original phrase is talking about both flowers and color, wechoose the first option. Our model learns to draw conclusions in exactly the same way, butworking with examples of fraudulent phrases.
After the emails have been filtered by content, we analyze the text and extract the mostrelevant fraudulent phrases. The logit model is responsible for this process (Logisticregression with L1 regularization). Training takes place using n-grams from texts obtained
as a result of primary filtering of the messages. Validation is carried out on the same data.
Thanks to combining the two algorithms, we automatically extract malicious text from thestreams and create terms for detecting suspicious messages.
We create heuristics that detect and stop Internal BEC attacks by combining andconsidering a combination of these terms, and analyzing in an email those domains thatare similar to the sender’s own.
However, we should never omit to be vigilant, despite of the continuous improvement inprotection systems against Internal BEC. As with any BEC threat, users need to respondvery carefully to messages that contain a request for a financial transfer or the disclosureof confidential data. If you receive a message from a colleague asking you to transfer acertain amount of money, or share data from an internal report, the best advice might beto implement your own ‘two factor authentication’ — call your colleague, write to them in amessenger or speak in person to clarify the details.

Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com
IT Security for Enterprise: kaspersky.com/enterpriseThreat Intelligence Portal: opentip.kaspersky.com

www.kaspersky.com© 2020 AO Kaspersky Lab.
Registered trademarks and service marks are the propertyof their respective owners.

We are proven. We are independent. We aretransparent. We are committed to building a saferworld, where technology improves our lives. Whichis why we secure it, so everyone everywhere has theendless opportunities it brings. Bring on cybersecurity
for a safer tomorrow.
Known more at kaspersky.com/transparency