Some accounts were used as hosts to send other phishing emails. It hasn’t been clear what the behavior looks like, what the attacker behavior looks like behind the scenes.” “We already know a lot of money is being lost from these attacks. “We saw attackers from 44 different countries all around the world,” Hassold said. Half were accessed within 12 hours, 91% within a week. Then they observed how quickly the accounts were compromised. “Over about a six-month period, we were able to identify more than 8,000 of these phishing sites and seed our credentials into them,” Hassold said. The company created fake email accounts, then used them to sign on to known phishing sites, most of which appeared to be legitimate business pages for companies including Dropbox, DocuSign and Microsoft 365. Hassold recently oversaw a study for the internet security company Agari. Half of accounts accessed within 12 hours, 91% within a week “$1.8 billion was lost in 2020 alone from BEC attacks,” said Crane Hassold.

Meanwhile, federal agents are still assessing damage from the SolarWinds hack, which was discovered last December.Įxperts have described that as the nation’s largest cyber-intrusion to date, with the City of Tampa listed as one of 18,000 entities whose computer network was potentially compromised.īut the FBI says 'business email compromise,' or BEC attacks account for the largest losses when it comes to cyber-crimes. companies were affected by a ransomware attack that started when hackers hit a Florida-based I-T company. A recent ransomware attack shut down the Colonial Pipeline, leading to long gas lines and driving up prices.ĭays later, another attack targeted JBS, the nation’s largest meat supplier. The study includes surprising new information about the tactics criminals use, how quickly they attack, and how compromised emails are used to commit fraud.Ĭybercrime is a growing concern in the United States and has become one of President Biden’s top priorities.

A first-of-its-kind study investigates exactly how cyber-criminals use email phishing attacks to steal billions.

Dropbox transfer scam