Account Update / Invoice Fraud Attack

技术

网络安全和隐私 - 身份认证管理
网络安全和隐私 - 网络安全
分析与建模 - 自然语言处理 (NLP)

适用行业

电信

适用功能

商业运营

用例

欺诈识别

服务

云规划/设计/实施服务
网络安全服务
系统集成

挑战

The telecommunications company (TCC) faced a sophisticated invoice fraud attack where an attacker impersonated a legitimate vendor to redirect a payment of over $700,000 to the attacker's account. The attacker used domain impersonation and engaged multiple employees over two months to build credibility and execute the attack.

关于客户

The customer in this case study is a telecommunications company referred to as TCC. Telecommunications companies are critical infrastructure providers that offer a range of services including internet, phone, and television to both consumers and businesses. These companies often handle large volumes of financial transactions and sensitive customer data, making them prime targets for sophisticated cyber-attacks. TCC, like many other companies in this sector, relies on a network of vendors and partners to maintain and expand its services. The company employs a large workforce and has multiple departments that handle various aspects of its operations, from technical support to financial management. Given the scale and complexity of its operations, TCC requires robust security measures to protect against various types of cyber threats, including Business Email Compromise (BEC) attacks.

解决方案

Abnormal Security detected and stopped the attempted invoice fraud using its Abnormal Behavior Technology (ABX). ABX combines the Abnormal Identity Model, Abnormal Relationship Graph, and Abnormal Content Analysis to detect and prevent such attacks. Specific techniques used include domain impersonation detection, natural language processing for text analysis, and vendor relationship detection. The solution was implemented in passive mode, allowing for a comprehensive view of the attack lifecycle without impacting email flow. Abnormal Security's platform integrates seamlessly with Office 365 and G Suite, requiring no configuration and minimal setup time.

运营影响

Abnormal Security's platform detected the domain impersonation early, raising suspicion and preventing the fraudulent payment.
The use of Abnormal Behavior Technology (ABX) allowed for high-confidence decisions, ensuring that legitimate transactions were not disrupted.
The platform's natural language processing capabilities helped in understanding the context and sentiment of the emails, aiding in the detection of the fraud attempt.

数量效益