Attack Vault

Showing

results

The Attack Vault contains samples of email-based cyber attacks targeting enterprise users, including business email compromise (BEC) attacks, financial supply chain fraud, credential phishing, malware attacks, and other types of scams. The email subject and body content of these samples can be searched and the repository can be filtered based on specific characteristics using the options below.

This collection of attack samples is not meant to be a comprehensive repository of all email-based threats. Rather, the Attack Vault contains a cross-section of various types of cyber threats--each containing a unique combination of tactics, themes, and/or content--to provide a general overview of some of the more notable attacks observed in today's email threat landscape.

Bonjour [Recipient First Name],

Maître Bergerot du cabinet juridique KPMG a t-il appelé?

Il s'agit d'un dossier confidentiel que je traite avec la cabinet, pour lequel il est impératif de communiquer uniquement par courriel.

Cordialement,

.[Executive Name]

French Executive Impersonation Legal Matter Payment Fraud BEC Attack

Subject:

Contact

Attack Date:

June 7, 2022

This text-based French-language BEC attack impersonates an executive using a spoofed email address, an extended spoofed display name, a maliciously registered domain, and a legal matter theme to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

French

See Attack Details

Hallo Gehaltsabrechnung,

Ich möchte das Konto auf meiner Gehaltsabrechnung in ein neues Konto

ändern und möchte wissen, ob es für die nächste Zahlung wirksam wird?

Vielen Dank

[Impersonated Employee Name]

[Impersonated Employee Title]

German Employee Impersonation Payroll Diversion BEC Attack

Subject:

Lohnkonto aktualisiert

Attack Date:

June 6, 2022

This text-based German-language BEC attack impersonates an employee using a spoofed display name and a free webmail account to divert payroll deposits to a fraudulent account.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payroll Diversion

Impersonated Party:

Employee - Other

Impersonated Brand:

Attachment Type:

Language:

German

See Attack Details

Dear [Recipient First Name],

We are in the process of buying an overseas company which will enhance our market position in Asia that I have approved and for which I need your help.

Has Adv. Hugues Moreau informed you about this case?

Regards,

[Executive Name]

Sent from Corp iPhone

Executive Impersonation Mergers & Acquisitions Payment Fraud BEC Attack

Subject:

Hugues Moreau

Attack Date:

May 31, 2022

This text-based BEC attack impersonates an executive using a spoofed email address, an extended spoofed display name, a maliciously registered domain, and a mergers & acquisitions theme to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Bonjour,

Maître LAMBERT du cabinet juridique KPMG aurait dû vous contacter par téléphone .

L'a-t'il-fait ou pas encore ?

Cordialement,

[Executive Name]

French Executive Impersonation Legal Matter Payment Fraud BEC Attack

Subject:

KPMG

Attack Date:

May 30, 2022

This text-based French-language BEC attack impersonates an executive using an extended spoofed display name, a matching malicious domain username, and a legal matter theme to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

French

See Attack Details

Hi [Recipient First Name],

Please send in all the current AR reports. I need you to sort through all account receivables by their due dates, i need to view all the updated records of all current and pending accounts on a spreadsheet as soon as possible. include the relevant emails ascribed to each contact information.

Treat as urgent.

Best regards

[Executive Name]

Executive Impersonation Aging Report Theft BEC Attack

Subject:

Account Review Printout

Attack Date:

May 30, 2022

This text-based BEC attack impersonates an executive using a spoofed email address and a free webmail account to request a copy of an aging report.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Aging Report Theft

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Hi [Recipient First Name] ,

Have you been contacted by Olivier Genevois from Dentons law firm about

the file OGDI6804, regarding a new project on which we are actually

working on?

Kind Regards,

[Executive Name]

Sent from my iPhone

Executive Impersonation Legal Matter Payment Fraud BEC Attack

Subject:

OGDI6804 / [TARGET COMPANY NAME]

Attack Date:

May 30, 2022

This text-based BEC attack impersonates an executive using an extended spoofed display name, a personalized email subject, a maliciously registered domain, and a legal matter theme to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Gοοd mοrning [Recipient First Name]

I need yου tο hαndIe α tαsκ fοr me. Γesροnd ωith yουr ωhαtsαρρ n∪mber αnd eχρect my messαge.

Best Γegads,

Employee Impersonation Gift Card Request BEC Attack

Subject:

AυαiIαbIe

Attack Date:

May 30, 2022

This text-based BEC attack impersonates an employee using a foreign character substitution, a WhatsApp number request, a spoofed display name, and a free webmail account to request the purchase of gift cards.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Gift Card Request

Impersonated Party:

Employee - Other

Impersonated Brand:

Attachment Type:

Language:

See Attack Details

Hur mycket är vårt tillgängliga saldo?, vi måste betala 39.891,22 euro, kan vi betala idag?

Hälsningar,

[Executive Name]

Swedish Executive Impersonation Payment Fraud BEC Attack

Subject:

saldo

Attack Date:

May 30, 2022

This text-based Swedish-language BEC attack impersonates an executive using a spoofed display name and a free webmail account to request a fraudulent payment.

No items found.

Type:

Business Email Compromise

Theme(s):

...

Tactic(s):

...

Vector:

Text-based

Goal:

Payment Fraud

Impersonated Party:

Employee - Executive

Impersonated Brand:

Attachment Type:

Language:

Swedish

See Attack Details

ATTN,

Please find attached invoice INV-11473 and forward to the appropriate party for payment processing.

Thanks,

Fake Invoice Credential Phishing Attack

Subject:

INV-11473

Attack Date:

May 27, 2022

This link-based attack impersonates a vendor/supplier using a fake attachment, an external compromised account, and a fake invoice theme to steal credentials.