Menace actors have usually used enterprise electronic mail compromise (BEC) assaults to steal cash from unwary organizations in recent times. However in a brand new twist, cybercriminals are utilizing them to steal meals shipments and substances from suppliers and distributors across the nation.The FBI and the Meals and Drug Administration Workplace of Felony Investigations (FDA OCI) on Dec. 16 issued an alert warning that the assaults have been happening since at the least the start of this yr and have price a number of organizations a whole bunch of hundreds of {dollars} in losses to this point.”Whereas BEC is mostly used to steal cash, in circumstances like this, criminals spoof emails and domains to impersonate workers of reliable corporations to order meals merchandise,” the 2 businesses mentioned within the joint cybersecurity advisory.Whereas the habits has a sure rat-like scavenging high quality to it, the objective behind these thefts usually is to repackage and resell the stolen meals gadgets with out regard for security and sanitation laws, they mentioned.A Fridge-Full of IncidentsThe advisory highlighted a number of examples — the earliest one going again to February — the place corporations have fallen sufferer to the rip-off. In a single incident in August, a meals distributor acquired an electronic mail order supposedly from the chief monetary officer of a multinational snack and beverage firm for 2 full truckloads of powered milk. The attacker used the precise title of the CFO however had an electronic mail handle that contained an additional letter within the area title than that of the true firm. The meals distributor fell for the rip-off and later needed to pay their provider greater than $160,000 for the fraudulent cargo.Additionally in February, a meals producer skilled greater than $600,000 in losses after receiving and transport orders for entire milk powder and nonfat dry milk from 4 completely different fraudulent corporations. In every occasion, the attackers used actual worker names and emails with slight variations of domains belonging to reliable corporations to position the orders.In one other incident in April, an ingredient provider acquired a request — purportedly from the president of one other giant meals producer — for pricing info for entire milk powder through the corporate’s Net portal. On this occasion, the provider ran a credit score verify on the spoofed meals producer, prolonged a line of credit score to the corporate, and made the primary of two $100,000 shipments to the criminals, earlier than realizing one thing was amiss. The FBI and FDA OCI alert talked about different incidents as properly the place criminals tried to tug off comparable heists however weren’t profitable. In every of those assaults, the criminals have created electronic mail accounts and web sites that look almost similar to these of a reliable firm however include almost indiscernible variations — for instance, an additional letter or substitute character akin to a “1” as an alternative of a lowercase “l.” Their ways have usually included getting access to a reliable firm’s electronic mail system and utilizing that to ship fraudulent emails to focused victims.So as to add additional legitimacy to their fraudulent communications, the attackers have used the precise names of executives and workers at reliable companies and used copied firm logos of their emails and different paperwork. The attackers have additionally used the precise enterprise info of reliable corporations to move credit score checks and acquire traces of credit score for fraudulently buying meals provides and substances from sufferer corporations.Losses proceed to mount from BEC assaults, though the meals theft scams are completely different from normal ways the place menace actors rip-off organizations into making fraudulent cash transfers. In 2021, losses from BEC assaults totaled almost $2.4 billion, making it one of the crucial financially damaging on-line crimes, in line with the FBI’s Web Crime Grievance Middle (IC3). Many BEC assaults goal small and midsize corporations, although giant organizations are sometimes victims as properly. A report that IC3 launched earlier this yr confirmed that BEC assaults are solely persevering with to develop and evolve. IC3 estimated that between June 2016 and final December, there have been some 241,206 BEC assaults that cumulatively brought on organizations worldwide a staggering $43 billion in losses.The Large TakeawayThe takeaway from these assaults is that menace actors may be intelligent and can adapt their strategies to search out methods round a corporation’s defenses, says Mike Parkin, senior technical engineer at Vulcan Cyber. “Whereas utilizing the BEC vector to steal completed meals shipments or uncooked supplies looks as if much more work than merely fooling the sufferer into sending money, that will have been the purpose,” he says. “The menace actors right here went for a novel scheme in an effort to slip below the radar and, presumably, steal greater than they may have gotten from a single faked bill.”Mika Aalto, co-founder and CEO at Hoxhunt, says the assaults on the meals business are a reminder of why BEC is the most expensive type of cybercrime worldwide. “We have known as BEC the kingpin of cybercrime up to now. Superior applied sciences will make BEC a monster, significantly for international corporations.”The FBI and FDA OCI urged organizations within the meals sector to play nearer consideration to vetting new prospects and distributors, particularly to issues like the brand new firm’s title and branding. “Rigorously verify hyperlinks and electronic mail addresses for slight variations that may make fraudulent addresses seem reliable and resemble the names of precise enterprise companions,” they famous. Organizations ought to search for extra punctuation, adjustments within the top-level domains, misspellings, and added prefixes or suffixes. They also needs to conduct periodic Net scans to make sure that attackers will not be spoofing their area and types, the advisory mentioned.