How the BEC Threat Landscape is Evolving and What We Can Do About It
summary
FBI figures and Agari data show BEC causes roughly 40% of cybercrime losses and $26B+ from 2016–2019 (about $708M/month); 2020 BEC losses hit $1.9B while related fraud pushes that actor ecosystem past $4B. Cashout shifts from wires to gift cards (50%+ of 2020), prepaid mule accounts and apps like Cash App and Paxful; new tactics include aging report attacks (~10% Jan 2021) and Russian group Cosmic Lynx. Defensive proof-of-concepts use active defense—seeding credentials, beacons, honeypots and engaging actors—collecting dozens of mule accounts over engagements that sometimes run months.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:45What is "Business Email Compromise?"
- 4:52Part of a Much Bieger Fraud Ecosystem
- 6:33Scattered Canary: 10-Year Evolution of a BEC Group
- 9:03Wire Transfers: The Ever-evolving Staple of BEC
- 13:32Payroll Diversion: A Landscape in Flux
- 15:36Payroll Diversion: A Tale of Two Halves
- 17:51Gift Cards: Still the #1 Goal of BEC Attacks
- 20:45Cryptocurrency & Prepaid Cards Fuel the BEC Engine
- 24:02Aging Reports: Vendor Email Compromise (without the compromise)
- 26:46BEC Actors Becoming More Geographically Diverse
- 29:45Cosmic Lynx's Target Profile
- 31:34What is Active Defense?
- 32:14Active Defense: How It Works
- 34:48Active Defense for Credential Phishing
- 35:44How Does Active Defense Help?
- 36:10Using Active Defense to Disrupt the BEC Ecosystem
related talks
51mModern Bank Heists
51mProblems in the Mirror Are Larger Than They Appear - True Horrors of BEC
47mBEC & Ransomware: Two Sides of the Same Cybercrime Coin
47mKey Trends in the Shifting Threats to Payments as Blended Commerce Returns
39mA New Era of Fraud: What Role Can Cyber Play?
46mThe State of Blockchain Security - 2023 Edition
35mFrom $10 to $30M: Operating in the Data-Extortion Aftermath
24mTop Fraud Trends in Crypto for 2024 and How to Stay Ahead in 2025