Security News > 2023 > March > Microsoft: Business email compromise attacks can take just hours
Microsoft's Security Intelligence team recently investigated a business email compromise attack and found that attackers move rapidly, with some steps taking mere minutes.
BEC attacks are a type of cyberattack where the attacker gains access to an email account of the target organization through phishing, social engineering, or buying account credentials on the dark web.
The attacker logged in to the victim's account on January 5, 2023, and spent two hours searching the mailbox for good email threads to hijack.
Microsoft 365 Defender generated a warning about BEC financial fraud 20 minutes after the threat actor deleted the sent email and automatically disrupted the attack by disabling the user's account.
"In our testing and evaluation of BEC detections and actions in customer environments faced with real-world attack scenarios, dozens of organizations were better protected when accounts were automatically disabled by Microsoft 365 Defender," claims Microsoft.
Microsoft says its security product has disrupted 38 BEC attacks targeting 27 organizations using high-confidence eXtended Detection and Response signals across endpoints, identities, email, and SaaS apps.
News URL
Related news
- VEILDrive Attack Exploits Microsoft Services to Evade Detection and Distribute Malware (source)
- Microsoft Exchange adds warning to emails abusing spoofing flaw (source)
- Microsoft patches Windows zero-day exploited in attacks on Ukraine (source)
- Microsoft 365 Admin portal abused to send sextortion emails (source)
- Microsoft Fixes AI, Cloud, and ERP Security Flaws; One Exploited in Active Attacks (source)
- Phishing-as-a-Service "Rockstar 2FA" Targets Microsoft 365 Users with AiTM Attacks (source)
- North Korean Kimsuky Hackers Use Russian Email Addresses for Credential Theft Attacks (source)
- Microsoft dangles $10K for hackers to hijack LLM email service (source)
- US sanctions Chinese cybersecurity company for firewall compromise, ransomware attacks (source)
- Microsoft enforces defenses preventing NTLM relay attacks (source)