Year summary · 2022

Email attacks in 2022

In 2022 the best-known identity attacks arrived by text message and push prompt, while email redirected city payments and opened Dropbox's code to an attacker.

Published · Sources checked · 3 min read

The pattern

The breaches that made headlines in 2022 mostly did not start with an email. The 0ktapus campaign, documented by Group-IB, reached employees by text message. Twilio and Cloudflare both received texts that sent staff to fake sign-in pages. Uber said an attacker with a contractor's stolen password sent repeated two-factor approval requests until the contractor accepted one. Cisco Talos described an attacker who got an employee's password from a synced personal Google account, then used voice calls and repeated push prompts until the employee approved one. These attacks targeted the moment of sign-in, not the inbox.

One of them failed, and the reason matters. At Cloudflare, three employees entered their credentials on the fake page. The logins still failed, because Cloudflare's staff used FIDO2 hardware keys, which only answer the genuine site.

Email did its work elsewhere. At Dropbox, a fake CircleCI login collected GitHub credentials and a one-time code. In city halls, emails redirected payments. Portland's mailbox was used from the inside. Eagle Mountain's thread was joined from the outside. Boulder County's impostor claimed the vendor had been hacked.

The cases

  1. 25 April 2022, announced 27 May

    Portland pays $1.4 million to an impostor writing from inside its own mailbox

    In April 2022 someone with access to a Portland Housing Bureau email account posed as a nonprofit builder and redirected a $1.4 million construction draw.

    • payment fraud
    • compromised mailbox
    • local government
    • housing

  2. August 2022

    Eagle Mountain, Utah: an impostor joins an email thread and takes $1.13 million

    In August 2022 someone slipped into an ongoing email conversation about a major infrastructure project and persuaded the city to send one payment to the wrong account.

    • payment fraud
    • thread hijacking
    • vendor impersonation
    • local government

  3. September 2022

    Boulder County: a fake vendor says it was hacked and asks for new payment details

    In September 2022 a fake vendor email redirected a $237,241.18 payment. The county got all of it back and now flags lookalike domains.

    • payment fraud
    • vendor impersonation
    • lookalike domain
    • local government

  4. 13 and 14 October 2022, disclosed 1 November

    Dropbox: a fake CircleCI login costs 130 code repositories

    In October 2022 emails posing as CircleCI led Dropbox engineers to a fake login. The attacker used their GitHub access to copy 130 code repositories.

    • credential phishing
    • developer tools
    • lookalike domain
    • MFA

Two more cases from the year are on record. Between October 2021 and April 2022, 139 real NHSmail accounts in England and Scotland were taken over and used to send 1,157 phishing emails, according to the email security company INKY. Because they came from genuine nhs.net addresses, they passed the checks that confirm a sender. And on 7 November 2022 a US federal judge sentenced Ramon Abbas, known as Hushpuppi, to 135 months in prison for laundering money from business email compromise and other online frauds. The court records do not describe the emails behind the schemes he was sentenced for, so his case is not counted in this archive.

The figures

FBI IC3 Internet Crime Report 2022
Measure2022
All complaints800,944
Reported losses, all crimes$10.3 billion
Phishing victims (rank 1)300,497
Business email compromise complaints21,832
Business email compromise adjusted losses (rank 2)$2,742,354,049

The report's own introduction gives total losses as more than $10.2 billion, while its charts and the FBI give $10.3 billion. Investment fraud overtook business email compromise as the costliest crime type that year. IC3's Recovery Asset Team placed a hold on about $433 million in business email compromise cases, a 73% success rate.

The UK's Cyber Security Breaches Survey 2022 again found that 39% of businesses had identified a breach or attack, and phishing was the most common threat for 83% of them. Verizon's 2022 report found the human element in 82% of breaches. It also found that only 41% of business email compromise cases involved phishing. The rest relied on other ways in, such as stolen credentials.

Sources

  1. Internet Crime Report 2022, FBI Internet Crime Complaint Center, March 2023.
  2. FBI Springfield release on the 2022 statistics, FBI, 22 March 2023.
  3. Cyber Security Breaches Survey 2022, UK government, 30 March 2022.
  4. 2022 Data Breach Investigations Report, Verizon, May 2022.
  5. Roasting 0ktapus: The phishing campaign going after Okta identity credentials, Group-IB, 25 August 2022.
  6. Incident Report: Employee and Customer Account Compromise, Twilio, 7 August 2022, updated 27 October 2022.
  7. The mechanics of a sophisticated phishing scam and how we stopped it, Cloudflare, 9 August 2022.
  8. Security update, Uber, September 2022.
  9. Uber hacked, internal systems breached and vulnerability reports stolen, Lawrence Abrams, BleepingComputer, 16 September 2022.
  10. Cisco Talos shares insights related to recent cyber attack on Cisco, Nick Biasini, Cisco Talos, 10 August 2022.
  11. Fresh Phish: Britain's National Health Service Infected by Massive Phishing Campaign, Roger Kay, INKY, May 2022.
  12. Phishing operation hits NHS email accounts to harvest Microsoft credentials, Jessica Lyons, The Register, 5 May 2022.
  13. Hushpuppi gets prison term for money laundering conspiracy, Al Jazeera, 8 November 2022.
  14. 'Gucci Master' business email scammer Hushpuppi gets 11 years, Sophos, November 2022.