Vendor Impersonation Payment Inquiry BEC Attack
Initial Email Content
Please advise once payment has been made so I can confirm with my AR department that it has been received. Once we have received payment, we will be able to update our records..
Thank you,
[Vendor Employee Name], CPA
Chief Financial Officer
PwC network.
PricewaterhouseCoopers LLP
411 Hamilton Boulevard
Peoria, Illinois 61602
United States
On Fri, May 20, 2022 at 6:51 AM [Executive Name] <send-via@mail-net-suites.com> wrote:
[Recipient First Name],
Could you please arrange ACH payment for this PWC LLP invoice today. See below and attached.
---------- Forwarded message ---------
From: [Vendor Employee Name] <[Vendor Employee Username]@accounts-pwc.com>
Sent: Thursday, May 12, 2022 10:14 AM
To: [Executive Name]
Cc: [Vendor Employee Name] <[Vendor Employee Username]@accounts-pwc.com>
Subject: PWC LLP: INVOICE# 001691134 PAYMENT DUE
A new invoice 001691134 has been generated and is attached for your review and payment.
Please make payment via ACH (Automated clearing house). Bank information is on the invoice.
If you are experiencing issues viewing the attached pdf via a mobile device, please use your standard mail client or webmail.
Thank you,
[Vendor Employee Name], CPA
Chief Financial Officer
PwC network.
PricewaterhouseCoopers LLP
411 Hamilton Boulevard
Peoria, Illinois 61602
United States
Malicious Artifacts
Additional Indicators of Compromise
Type
Description
Attack Description
This text-based BEC attack impersonates a vendor/supplier using a fake email chain, a look-alike domain, and a payment inquiry theme to request a fraudulent payment.