Threats Tagged 'business email compromise'

In Q2 2026, Microsoft observed approximately 7.6 billion email-based phishing threats, with a decline in monthly volumes from April to June. The disruption of the Tycoon2FA phishing-as-a-service platform by Microsoft's Digital Crimes Unit caused a 92% drop in related phishing activity. QR code phishing and CAPTCHA-gated phishing attacks also saw significant decreases. Credential phishing remained the primary goal, comprising 94-96% of payload-based attacks. Business email compromise activity normalized after a spike in April. Meanwhile, Microsoft Teams-based threats increased sharply, with malicious call attempts nearly ten times higher than mid-2025 levels by the end of the quarter.

An investigation beginning with a single RedLine Stealer C2 server from VMRay UniqueSignal evolved into uncovering a targeted Business Email Compromise campaign against South Korean maritime infrastructure. The analysis started with IP 194.156.79.122 on port 55615, leveraging fingerprinting techniques through FOFA and VirusTotal to identify additional C2 infrastructure. Pivoting through communicating files revealed spear-phishing emails targeting Kangrim Heavy Industries, a major South Korean marine boiler manufacturer. The campaign delivered Formbook malware through impersonated maritime supply chain companies. Further infrastructure analysis identified seven fraudulent domains hosted on TheHost LLC infrastructure, utilizing similar naming patterns and TLS certificates. The attack demonstrates sophisticated BEC tactics combining malware delivery with social engineering, mimicking legitimate business correspondence within the maritime shipping sector.

MediumMalwareSouth Korea#spear-phishing#south korean victims#business email compromise