The pattern
In 2023 the documented email attacks found new ways around the checks in front of the reader. Cofense saw QR codes in Microsoft-themed alerts, mostly aimed at one US energy company. The link sat inside a picture, where many filters do not look. Barracuda's email gateways were broken by the attachments they were scanning, so no reader was needed at all.
Payment fraud grew more patient. In New Haven the attackers read a school manager's mailbox for weeks before they wrote as the bus company. In Fort Lauderdale the request arrived with forms that matched the contractor's earlier paperwork. Across the year, the fraudster who did the most homework wrote the least suspicious email.
The year also brought a new tool for writing it. In July 2023 the email security company SlashNext described WormGPT, a chatbot sold on a cybercrime forum as an alternative to ChatGPT with no ethical limits. SlashNext asked it to write an email pressuring an account manager to pay a fraudulent invoice, and called the result remarkably persuasive. In August, KrebsOnSecurity identified the developer behind it.
The cases
-
October 2022 to May 2023, disclosed 23 May 2023
Barracuda's email gateways hacked by the emails they were scanning
From October 2022 crafted attachments broke into Barracuda's email security gateways as they scanned them. Barracuda told customers to replace affected devices.
-
Late May to June 2023, disclosed August 2023
New Haven schools pay $5.9 million to a fake school bus company
In 2023 attackers read a school manager's mailbox, then posed as the bus contractor. Six payments went out before the real company asked where its money was.
-
May to August 2023
QR codes in fake Microsoft alerts flood a major US energy company
From May 2023 more than 1,000 emails carried QR codes that led to fake Microsoft 365 logins. About 29% of them went to one large US energy company.
-
14 September 2023, recovered January 2024
Fort Lauderdale pays $1.2 million to a fake police headquarters builder
In September 2023 the city paid a request that posed as the contractor building its new police headquarters. The paperwork looked right. Police later recovered the money.
A related case ran from September 2023 into 2024. Attackers inside the Microsoft accounts of the town of Arlington, Massachusetts, watched email about the high school building project, then posed as the vendor from a domain that appeared genuine. They asked to switch from checks to electronic transfer, and set inbox rules to hide incoming messages. Four monthly payments, $445,945.73 in total, went to them before the vendor reported it had not been paid.
What was not email
Two well-known 2023 cases are often filed under phishing, but the sources do not show an email. In August Microsoft described Midnight Blizzard sending lures through Microsoft Teams chats, from renamed tenants posing as technical support, against fewer than 40 organisations. The channel was Teams. In February Reddit said a highly targeted phishing attack had sent employees plausible-sounding prompts that led to a fake intranet login. It did not say how the prompts arrived.
The figures
| Measure | 2023 |
|---|---|
| All complaints | 880,418 |
| Reported losses, all crimes | over $12.5 billion |
| Phishing and spoofing complaints (rank 1) | 298,878 |
| Business email compromise complaints | 21,489 |
| Business email compromise adjusted losses (rank 2) | $2,946,830,270 |
From 2023 IC3 counts phishing and spoofing together. On that basis its report restates the earlier years as 342,494 complaints in 2021 and 321,136 in 2022. The Recovery Asset Team placed a hold on $538.39 million, a 71% success rate.
The UK's Cyber Security Breaches Survey 2023 found that 32% of businesses recalled a breach or attack in the previous year, and phishing was involved for 79% of them. Verizon's 2023 report found that business email compromise had almost doubled in its incident data and made up more than half of social engineering incidents. Drawing on IC3 data, it put the median business email compromise at around $50,000.
Sources
- Internet Crime Report 2023, FBI Internet Crime Complaint Center, 6 March 2024.
- Public service announcement on the 2023 report, FBI Internet Crime Complaint Center, 18 March 2024.
- Cyber Security Breaches Survey 2023, UK government, 19 April 2023.
- 2023 Data Breach Investigations Report, Verizon, June 2023.
- WormGPT: The Generative AI Tool Cybercriminals Are Using to Launch Business Email Compromise Attacks, Daniel Kelley, SlashNext (via Security Boulevard), 13 July 2023.
- Meet the Brains Behind the Malware-Friendly AI Chat Service 'WormGPT', Brian Krebs, KrebsOnSecurity, 8 August 2023.
- Massachusetts town loses $445,000 in email scam, Sophia Fox-Sowell, StateScoop, 10 June 2024.
- Massachusetts Town Loses $446,000 in Cyber Attack, Andrew G. Simpson, Insurance Journal, 12 June 2024.
- Midnight Blizzard conducts targeted social engineering over Microsoft Teams, Microsoft Threat Intelligence, 2 August 2023.
- Russian government hackers sent phishing lures masquerading as Microsoft Teams chats, Jonathan Greig, The Record, 2 August 2023.
- Reddit admits it was hacked and data stolen, says "Don't panic", Paul Ducklin, Sophos Naked Security, February 2023.
- Reddit breached, here's what you need to know, Christopher Boyd, Malwarebytes, 10 February 2023.