Increase in BEC Attacks Targeting K-12

Summary

Microsoft Security Intel detected an increase in business email compromise (BEC) attacks targeting K-12 teachers. Rather than using compromised email accounts, the attackers in this campaign registered new accounts using free email service providers such as Gmail, Mail[.]ru, Yahoo, Hotmail, Outlook, and iCloud. The attackers used these accounts to impersonate school personnel, likely identified using the school’s website or social media, in order to fraudulently request gift cards. Some universities have noted the spike as well. The attackers behind this campaign were also observed using COVID-19 lures in a similar BEC gift scam.

Recommendations

The NJCCIC recommends users educate themselves and others on these types of attacks. We suggest reviewing these red flags, and to contact the sender via an alternate means of communication prior to fulfilling any requests. Additional reporting can be found in the Security Week article.