Contain the Intrusion — Minutes Matter
BEC is the most financially damaging cybercrime category globally — the FBI puts cumulative losses above $50 billion. When an account is compromised, delay directly increases damage: fraudulent transactions go through, data gets exfiltrated, and attackers pivot to additional accounts.
We activate immediately on engagement. The first priority is stopping ongoing attacker activity — locking accounts, killing active sessions, and pulling any persistence mechanisms they've left behind.
- Immediate account lockdown and active session revocation across all compromised mailboxes
- Establishing the compromise window — when attacker access started and what was touched
- Forensic preservation of audit logs, sign-in records, and mailbox activity before any remediation steps alter the trail
- Removal of attacker persistence — inbox forwarding rules, transport rules, OAuth app grants, and delegated mailbox access
- Lateral movement check — did the attacker reach SharePoint, OneDrive, Teams, or additional accounts?
- Immediate notification guidance for affected parties, banks, and payment processors
M365 & Google Workspace Forensics
Once containment is done, we dig into exactly what happened. Our forensic work covers the full attack timeline — initial access through final exfiltration — and produces documentation suitable for regulatory notifications, insurance claims, and law enforcement.
- Unified Audit Log (UAL) analysis for M365 or Google Workspace Admin console audit log review
- Mailbox forensics — sent items, deleted items, search queries, and attachment access
- Mail flow rule analysis — inbox rules, transport rules, auto-forwarding to external addresses, and journal rules
- OAuth application audit — malicious app consent grants, third-party delegated access, and token theft indicators
- Sign-in analysis — IP geolocation, device fingerprinting, MFA bypass indicators (e.g. EvilginX/AiTM proxy sessions), and impossible travel detection
- Attacker TTP mapping against MITRE ATT&CK for Enterprise — specifically the Initial Access, Persistence, and Collection tactics relevant to BEC
- Data exfiltration assessment — what emails, attachments, and files were accessed or downloaded
Intercept Funds & Support Recovery
BEC is financial fraud. The attacker wants wire transfers diverted, invoices manipulated, or payroll redirected. When fraudulent transactions are already in motion, how fast you act determines how much you recover. We work directly with your finance team, banks, and law enforcement.
- Immediate liaison with receiving and sending banks to initiate recall and hold procedures
- IC3 (FBI Internet Crime Complaint Center) filing support for US-based incidents
- Action Fraud and National Fraud Intelligence Bureau reporting for UK-based incidents
- Payment processor notification and chargeback initiation where applicable
- Documentation package for insurance claims (cyber liability and crime policies)
- Law enforcement liaison — providing forensic packages suitable for criminal investigation
Understanding BEC Attack Patterns
BEC isn't one technique — it's a category of attacks where compromised or spoofed business email is used to commit fraud. Knowing the pattern tells us what the attacker was after and what's already happened.
Invoice Fraud
Attacker compromises a supplier account or spoofs the domain, then modifies banking details on legitimate invoices mid-thread. Payments land in attacker-controlled accounts.
CEO / Executive Fraud
Attacker spoofs or compromises a senior executive's account to pressure finance staff into urgent wire transfers or gift card purchases — bypassing normal approval chains.
Payroll Diversion
Attacker impersonates an employee or compromises HR's mailbox to redirect salary payments before the next payroll run. Often sits undetected until the employee reports missing pay.
OAuth Token Theft & Account Persistence
Rather than stealing passwords, attackers use AiTM phishing proxies (e.g. Evilginx) to harvest session cookies post-MFA, or trick users into granting OAuth consent to malicious apps — maintaining access even after a password reset.
Harden Your Environment Before the Next Attack
Most BEC incidents exploit weak email authentication, inadequate MFA, and a lack of out-of-band payment verification. After incident resolution, we help fix the specific controls that failed.
- Email authentication hardening — DMARC enforcement, DKIM signing, and SPF alignment
- Phishing-resistant MFA deployment — hardware keys or FIDO2 to defeat AiTM proxy attacks
- Conditional Access policy hardening — restricting legacy auth, enforcing compliant devices
- BEC simulation exercises — targeted phishing campaigns against finance and executive teams
- Payment verification procedure design — out-of-band confirmation for all wire transfers above defined thresholds
- Incident response playbook — so the next incident gets contained faster