V is for Vendor: The Emergence of Vendor Email Compromise

From Compromise to Cash-Out

Silent Starling, comprised of three main threat actors, has found success in compromising email accounts, gathering data from them, and then targeting appropriate contacts at the right time. The group consistently targets suppliers and vendors in their initial attacks, using phishing emails to encourage employees to divulge passwords, which can then be used to access the email account. Once this information is available, Silent Starling sets up a forwarding rule so the group receives copies of all emails into the account.

Seeing Success with VEC

Since Silent Starling moved to vendor email compromise as a major attack type in 2018, the group has seen enormous success. In the course of our research, our team was able to document the successful infiltration of more than 700 employee email accounts spanning more than 500 companies. Combined, these accounts provided more than 20,000 sensitive emails, giving Silent Starling access to thousands of data points.

--

--

Agari is the Trusted Email Identity Company™, protecting companies and people from phishing and socially-engineered email attacks.

Love podcasts or audiobooks? Learn on the go with our new app.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Agari

Agari

Agari is the Trusted Email Identity Company™, protecting companies and people from phishing and socially-engineered email attacks.