External Third Party Impersonation Payment Inquiry BEC Attack
Initial Email Content
Dear Colleagues & AP Team,
Please be informed that we have not yet received payment with respect to these invoices.
2/2111/01-2/2203/01 for Eurocontrol Belgium(Nov. to Dec., 2021 & Jan.-Mar 2022)
HE/2111/01-2/2203/01 for Eurocontrol Belgium Egypt(Nov. to Dec., 2021 & Jan.-Mar 2022)
UM/2111/01-2/2203/01 for Eurocontrol Belgium Belarus(Nov. to Dec., 2021 & Jan.-Mar 2022)
05/2111/01-2/2203/01 for Eurocontrol Belgium Netherlands(Nov. to Dec., 2021 & Jan.-Mar 2022)
IC/2111/01-2/2203/01 for Eurocontrol Belgium Ireland(Nov. to Dec., 2021 & Jan-Mar 2022) ETC.
You are hereby advised to settle these bills as soon as possible because some of the invoices are already in arrears. Also please advise if these payments have been remitted and kindly provide to us by return email the copy of the swift confirmation and proofs of payment , to enable us reconcile our accounts and to further advise you on future transactions and payments.We regret all inconveniences and plead that you bear with us.
Thanks for your cooperation. we await your prompt response.
My best regards
[Impersonated Third Party Name]
General Manager Accounts
Head of CAT / CO2 (Collection of Air Navigation Charges)
CRCO / CAT / CO2
EUROCONTROL
96 Rue de la Fusée, 1130 Brussels, Belgium
Email: [Impersonated Email Address]
Attack Screenshots
Malicious Artifacts
Additional Indicators of Compromise
Type
Description
Attack Description
This text-based BEC attack impersonates an external third party using display name spoofing, a look-alike domain, and a payment inquiry theme to request a fraudulent payment.