Attack Vault
The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.
This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.
Hello [Recipient First Name],
Please forward me the A/R aging report (due within the next 30 days and a month overdue) and also include customer payable contact names and emails. Treat as urgent.
Thank you,
[Executive Name]
[Executive Title]
[Target Company Name]
Executive Impersonation Aging Report Theft BEC Attack
This text-based BEC attack impersonates an executive using a maliciously registered domain and a spoofed display name to request a copy of an aging report.
Hi [Recipient First Name],
Please find attached our updated payment details attached. Kindly note all payment should be made to our chase bank.
Kindly acknowledge receipt and revert in case of any query.
Regards,
AR Team,
[Vendor Company Name]
From:[Vendor Company Name] <[Vendor Email Address]>
Sent:Thursday, June 23, 2022 3:08 PM
To:[Hijacked Thread Original Recipients]
Cc:[Hijacked Thread Original Recipients]
Subject: [Hijacked Thread Subject]
[Hijacked Thread Content]
Vendor Impersonation Account Update BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a hijacked email thread, a look-alike domain, an external compromised account, and an account update theme to request a fraudulent payment.
Attn: Accounts Payable Manager:
[Vendor Company Name] greatly appreciates you as a valued customer and we want to thank you for your continued business.
Our office will like to update our Bank Account information details you have on file
Please note, Mailing of check payments has been temporarily put on hold for now until further notice, All payments has to go through Direct Deposit ACH payment and Wire transfer
Could you please check if you have any open invoice payable to us as accounting is still not able to get onto the server or into Oracle to review accounts or post payments that may have been received.
Best Regards
[Vendor Employee Name]
Vendor Impersonation Account Update BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a look-alike domain, a spoofed display name, and an account update theme to request a fraudulent payment.
Hi [Recipient First Name],
I need you to take care of a financial obligation in order to finalize an agreement. Kindly get back to me so i can forward you the Instructions as received for processing so i can proceed.
Thanks.
Executive Impersonation Mergers & Acquisitions Payment Fraud BEC Attack
This text-based BEC attack impersonates an executive using a spoofed display name, a maliciously registered domain, and a mergers & acquisitions theme to request a fraudulent payment.
Hyvää huomenta [Recipient First Name]
Tarvitsen hetken sinulta. Kerro minulle, jos olet vapaa. Jätä minulle WHATSAPP-numerosi, jotta voin kirjoittaa sinulle.
Terveisiä
[Executive Name]
Finnish Executive Impersonation Gift Card Request BEC Attack
This text-based Finnish-language BEC attack impersonates an executive using a personalized email subject, a WhatsApp number request, a spoofed display name, and a free webmail account to request the purchase of gift cards.
Hi [Recipient First Name],
We hired a private contractor and we need to make a one-off payment for them. Can we set up a payment for this vendor today?
Regards,
[Executive First Name]
Executive Impersonation New Vendor Payment Fraud BEC Attack
This text-based BEC attack impersonates an executive using a maliciously registered domain, a spoofed display name, and a new vendor theme to request a fraudulent payment.
Good day!
You can look on a complete list of the needed documents here in one document:
hXXp://rsmzi[.]com/et/uiutsotsn
File password: U523
Hi [Impersonated Employee First Name],
This is received will revert soonest.
Regards
[Recipient Name]
¨"¨
From: [Impersonated Employee Name] <[Impersonated Employee Email Address]>
Sent: Tuesday, September 28, 2021 9:25 AM
To: [Hijacked Thread Recipients]
Subject: RE: AMENDED SALE AGREEMENT
[Hijacked Thread Contents]
Fake Document Link-based Malware Attack
This link-based attack impersonates an employee using a hijacked email thread, an external compromised account, a spoofed display name, and a fake document theme to deliver malware.
Good Morning,
As of 06/17/22, we have transitioned from Bank Of America to our Chase Bank. We are still receiving lock box/ACH payments into the Bank Of America account which will be permanently closed as of 06/27/22. Please confirm that you have updated your records to reflect the correct banking information listed in the letter attached. Sorry for any inconveniences this might cause.
Thanks!
[Vendor Employee Name]
[Vendor Employee Title]
[Vendor Company Name]
Vendor Impersonation Account Update BEC Attack
This text-based BEC attack impersonates a vendor/supplier using a spoofed email address, a look-alike domain, a personalized email subject, and an account update theme to request a fraudulent payment.
<p>Good Day,</p><p><br></p><p>We are currently reviewing our accounting system. Can I please get all the receivables by their due dates? This report should include their various email addresses in an excel spreadsheet.</p><p><br></p><p>How soon can you sort this ?</p><p><br></p><p>Treat as urgent.</p><p><br></p><p>Regards. </p>
Executive Impersonation Aging Report Theft BEC Attack
This text-based BEC attack impersonates an executive using a personalized email subject, a maliciously registered domain, and a spoofed display name to request a copy of an aging report.
Dear [Recipient First Name],
I would like to request that the information associated with my pay account be changed from its present status to the account listed below.
Account holder's name:[Impersonated Employee Name]
[Account Number] is the account number.
Number for routing: 124 303 120
To confirm that it has been updated, kindly respond to me.
with heartfelt regards,
[Impersonated Employee Name]
Employee Impersonation Payroll Diversion BEC Attack
This text-based BEC attack impersonates an employee using a spoofed display name and a free webmail account to divert payroll deposits to a fraudulent account.
