Business Email compromise groups (BECs) are an ongoing threat globally to businesses. Their overarching objective is to siphon employee credentials, business intellectual property and persuade employees to complete transactions to fraudulent accounts unknowingly.

These BECs can covertly enter a company’s network, not through their technical expertise but through heavy reliance on malware purchased from threat groups and developers (Malware as a Service). This malware purchased by the BECs forms their methodology for breaching businesses. Combined with social engineering, this provides the perfect recipe to infect a company’s network. BECs often select their targets by using search engines and email scraping tools to find email listings.

BECs’ methodology differs depending on the end objective. For example, BECs can install malware such as a keylogger on an unsuspecting employee device via a phishing email. A keylogger will track the input made by an employee on their device over an extended period. This information is sent to the BEC’s command-and-control (CnC) server, which provides them with insights into four key components: