FBI warns of BEC scammers impersonating construction companies

The Federal Bureau of Investigation (FBI) warned private sector companies of scammers impersonating construction companies in business email compromise (BEC) attacks targeting organizations from multiple US critical infrastructure sectors.

BEC scammers use various tactics (including social engineering and phishing) to compromise or impersonate business email accounts with the end goal of redirecting pending or future payments to bank accounts under their control.

The warning was issued via a TLP:GREEN Private Industry Notification (PIN) sent to organizations today to help cybersecurity professionals defend against these active attacks.

According to the FBI, threat actors exploit construction companies' ongoing, completed, or awarded business relations to defraud their private and public sector clients.

BEC campaign started in March

The incidents are part of a campaign that started in March 2021 and has already resulted in financial losses ranging from hundreds of thousands to millions of dollars.

To successfully pull off these BEC attacks, the scammers use information collected via online services on construction companies they impersonate and the customers they're targeting.

Platforms used for harvesting valuable data (e.g., contact info, bid data, and project costs) include local and state government budget data portals, as well as subscription-based construction industry data aggregators.

The information harvested by the attackers allows them to custom-tailor emails designed to exploit the business relationship between the victim and the construction contractors.

To make the messages more convincing, the scammers send emails asking the targets to change direct deposit account and automated clearing house (ACH) information. The new account info points to bank accounts under the fraudsters' control.

These emails are sent using domains spoofing the contractors' legitimate sites and legitimate company logos and graphics to increase the chance that the victims will not be able to tell that the messages are fraudulent.

Almost $2 billion lost to BEC scams in 2020

In March, the FBI also warned of another series of BEC attacks increasingly targeting US state, local, tribal, and territorial (SLTT) government entities, with losses ranging from $10,000 up to $4 million between November 2018 and September 2020.

Last month, Microsoft detected a large-scale BEC campaign that targeted over 120 organizations using typo-squatted domains registered a few days before the attacks started.

FBI's 2020 annual report on cybercrime affecting US victims listed a record number of complaints and financial losses last year.

"The FBI's Internet Crime Complaint Center (IC3) notes BEC is an increasing and constantly evolving threat as criminal actors become more sophisticated and adapt to current events," the FBI said.

"There was a 5 percent increase in adjusted losses from 2019 to 2020, with over $1.7 billion adjusted losses reported to IC3 in 2019 and over $1.8 billion adjusted losses reported in 2020."

In other alerts issued last year, the FBI warned of BEC scammers exploiting email auto-forwarding and cloud email services such as Microsoft Office 365 and Google G Suite in their attacks.