According to Clint Boulton the Senior writer at CIO; Fraudsters are using legitimate executive names and email addresses to dupe unsuspecting employees to wire money or sensitive documents to their accounts. The CTO of the Boston Celtics, for one, is fighting back.
A clever variant of phishing scams is proliferating among enterprises, forcing CIOs to up their game even as they are still refining their cyber security practices to contend with various zero-day attacks. Called whaling, the social engineering grift typically involves a hacker masquerading as a senior executive asking an employee to transfer money.
Jay Wessland, CTO of the Boston Celtics.
"We have seen a few of those," says Jay Wessland, CTO of the Boston Celtics. He says atypical example he's seen involves someone pretending to be CEO or CFO who emails a high-level employee in the finance department to wire money or W2 tax forms. He says whaling attacks, a form of business email compromise also known as "CEO fraud," have increased over the past few months.
FBI says whaling is becoming big trend
Whaling is becoming a big
enough issue that it's landed on the radar of the Federal Bureau of Investigation, which
last week said that such scams
have cost companies more than $2.3 billion in losses over the past three years.
The losses affect every U.S. state and in at least 79 countries. The FBI said
that it has seen a 270 percent increase in identified victims and exposed
losses from CEO scams since January 2015. For example, Mattel lost $3 million in 2015 to one CEO fraud scam, while Snapchat and Seagate Technologies also
fell prey to similar schemes.
Unlike typical phishing or spearphishing scams, in which an attacker typically includes a malicious URL or attachment, whaling is a pure social engineering hack targeting relationships between employees, says Steve Malone, director of security product management at Mimecast. Whaling fraudsters either gain access to an executive's email inbox, or email employees from a fake domain name that appears similar to the legitimate domain name. They ask the intended recipient to take some action, such as moving money from a corporate account to an account the fraudster has set up, Malone says.
