BEC Group Uses Manufactured Email Threads and Brand Impersonation to Facilitate Invoice Fraud

After the recent meteoric rise in social engineering attacks, security leaders are working to better educate their workforces on how to spot and report potential threats. Unfortunately, scammers consistently remain a step ahead. By the time a company becomes adept at identifying and preventing one type of threat, attackers have already evolved their tactics to something even harder to detect.

Recently, we identified a new trend in business email compromise attacks that combines vendor impersonation and executive impersonation within a single email attack. Now, a group known as Cobalt Terrapin is consistently leveraging this tactic to deceive accounting professionals and commit invoice fraud.

Cobalt Terrapin appears to be located in Turkey and has been active since at least March 2022. The group commonly impersonates well-known vendors, like LinkedIn and ZoomInfo, and has discovered a stealthy practice for bypassing legacy security systems.

Like many financially-motivated BEC attacks, invoice fraud occurs when cybercriminals target finance teams, impersonate an executive or vendor, and convince them to pay a fake invoice. In the case of internal vendor impersonations or reconnaissance vendor incidents, attackers pose as vendors that their targets are familiar with or currently using as part of normal business operations.

In the past, fraudsters sent simple messages and attached PDFs with realistic-looking invoices that included bank account information. But newer attacks are much more elaborate and well-researched, often containing fake email chains with the names and email addresses of real individuals at the target organization—adding legitimacy to these attacks.

Because these attacks are highly targeted and personalized, they’re virtually undetectable by conventional threat intelligence tools and yield threat actors a hefty profit. According to the most recent FBI IC3 Internet Crime Report, the average BEC attack caused more than $120,000 in losses per incident. And Abnormal research shows that invoice fraud is even higher, with attackers requesting an average of $183,000 per attack.

While many BEC attacks appear to originate from a high-ranking individual at an organization or from a well-known vendor, Cobalt Terrapin uses a new hybrid strategy that combines both tactics. This makes communications look and feel even more legitimate.

In this case, the attacker sends an email impersonating a company executive—usually the company’s CEO or CFO—using display name spoofing. They also set up a manufactured message from a vendor in the body of the email below the message from the executive making it appear like the sender is forwarding an existing thread.

The email instructs the recipient, typically a generic email address like ap[@]company.com or accounting[@]company.com to pay the outstanding invoice referenced in the manufactured email chain below. It is notable that, rather than identifying specific individuals to target, Cobalt Terrapin identifies the central accounts payable email list they can use to reach all of the employees on that list at once. In many ways, this is likely to make them more successful as they can reach multiple people at once, and it only causes one hurried or distracted employee to make the mistake.

Attackers also recognize that if an invoice looks different from usual, it might set off alarm bells to the accounting team. To address this, Cobalt Terrapin emails include a note explaining that the company has made “improvements” to its invoices as part of an “ongoing commitment to deliver a better billing experience” and recommends the recipient check out the vendor’s website to “learn more about your new invoice.”

Although these emails typically reference an attached email, attackers wait until the targeted employee responds before sending a fake invoice or W-9. This helps them bypass security tools that flag attachments as a sign of potential attacks. And given the frequency with which people forget to attach files to emails, most email users wouldn’t consider this unusual or suspicious behavior.

Another tactic Cobalt Terrapin uses to increase its legitimacy is invoking familiar, easily-recognizable brand names. For example, its domains are primarily registered with Google and include references to Microsoft, and its email addresses use lookalike domains.

In most cases, lookalike domains are registered with a different registrar at an earlier time from the domain used to send the email. Typically, they’re visually similar to the domains threat actors are attempting to spoof, such as “gooogle.com” or “LinkedIIn.com.”

In this case, spoofed emails include email domains like “sender-secure-response-mail.management” and “email-onmicrosoft365-onmicrosoft.com” which, while they are much longer than average, they rely on references to security and well-known brands to add legitimacy. And because many email programs only show senders’ display names, busy employees rarely notice if a domain name is slightly altered, misspelled, or entirely different from an impersonated sender’s other emails.

Additionally, Cobalt Terrapin commonly impersonates LinkedIn, which is meaningful for a few reasons. First, professionals are accustomed to receiving emails from LinkedIn, so the name won’t stand out as unusual. Second, many organizations leverage LinkedIn’s paid marketing and recruiting tools, and it’s not atypical to receive multiple invoices or invoices that vary in price from month to month. Third, it’s a large, well-known, and trusted brand that’s easy to co-opt for nefarious purposes. In fact, in the Abnormal H2 2022 Email Threat Report, our team found LinkedIn was the most impersonated platform in the first half of 2022.

Cobalt Terrapin uses highly convincing invoices and W-9s, which include corporate logos and legitimate corporate details, such as the organization’s real address and employee identification number (EIN). While it may seem like a lot of trouble, including these small details in spoofed documents help threat actors bypass accounting professionals’ scrutiny and allow for faster time to payment.

Social engineering methods like those commonly used in business email compromise attacks are growing more sophisticated because it’s becoming more challenging to fool security-aware workforces and bypass security software. But attacks like those perpetrated by Cobalt Terrapin prove scammers know how to covertly manipulate multiple email elements in their favor. The fact that they are using a combination of vendor and executive impersonation, domain spoofing, and legitimate-looking invoices shows just how far they’re willing to go run their scams.

To bolster your security, educate staff on emerging threats and remind them to always carefully examine senders’ email addresses, particularly when emails contain requests to pay invoices, transfer funds, or handle any other finance-related task. It’s also vital for email recipients to verify unusual requests through another channel, like a text message or phone call.

Unfortunately, as attacks grow in sophistication, education isn’t always enough to mitigate the risk. In addition to training your team, it’s crucial you implement more innovative and reliable email security solutions. Behavioral AI-based security can analyze email content and identities, recognize signs of an attack, and prevent malicious emails from reaching their target. This way, you can identify and block social engineering attempts your legacy systems may not catch.

Learn how Abnormal protects organizations from sophisticated and emerging attacks. Request a demo today.