I am constantly seeing and hearing more talk about the risk posed by insiders when it comes to business risk. The talk of insider risk and the threat to the business, threats to compliance and security has been amplified in recent weeks, yet very few businesses have any form of Insider Risk Management program in place. 

Why is this?

Do we not know where to start, or are we scared of what we might find?

Large and small business all show different levels of support or acceptance of the importance of insider threats. Sadly, the importance they place on these are totally worthless if only in words.

In the last couple of weeks we have seen reports of top secret government information being leaked/lost/copied on different sides of the Atlantic.

Microsoft 365 servers contain extremely sensitive information and most organisations simply cannot do without it for an extended period of time. Zero-day attacks – those attacks that take advantage of a vulnerability in software or firmware, and found by cybercriminals before a vendor can issue a fix – are one of the cybercriminal’s greatest advantages.

Often providing privileged access, zero-day attacks become the means for a single cybercriminal group to potentially gain access to literally tens or hundreds of thousands of organisations in every geography, industry vertical, size and country. There are even posts on the dark web by cybercriminal gangs offering as much as $3 million for a zero-day remote code execution exploit.

According to a recent analysis, there were 80 zero-day vulnerabilities exploited in 2021, a 166% increase from 2020, with Microsoft, Apple and Google products most frequently targeted.

Over the last month the J2 Software team have noticed an increase in an evolved method in change of bank details or payment fraud. While this might sound like old news, this now more directly involves the CEO.

Traditional payment fraud has been rife for some time where the cyber criminal impersonates the CEO, or other senior members of staff, to convince the finance department to make an urgent payment to either a new supplier or update their bank details. The change of bank detail fraud uses fake banking confirmation letters and the trust of finance people to update an existing supplier’s details. The growing number of successful attacks have proven to be very costly to businesses of all sizes. Owing to this, many businesses have now implemented stronger verification processes to verify supplier bank details changes, which means that the criminals have had to change their approach and tactics.

This trend involves an internal change of bank details, mostly for the CEO. The cyber criminal impersonates the CEO by using an external email address, claiming that it is their private email address, and requests that their bank details for payroll is updated. All of these use similar wording and it is usually done a week before payroll, to stress the urgency. To make sure that they pay their CEO, many of these changes have been successful. The finance or HR team update the details and the cyber criminal is paid, after which they rapidly get the money out before anybody notices.

Cybercriminals are constantly adapting their approach to deceive their targets and increase their success rate. There is a new trend developing that speaks directly to this phenomenon, it is an adapted version to completing a successful change of bank details fraud.

Many people have seen and encountered the standard approach to change of bank details fraud, also known as invoice fraud. This is where an attacker pretends to be a supplier, they create fake change of bank details letters and email the accounts department to get bank details updated.

The attack method is nothing new, but the execution has simply evolved. The end game is the same, to steal your money; but the criminal syndicate now uses the fact that most people are working from home to target their prey with a more personal approach.