What is a VEC attack
to this kind of Phishing variant it is known as VEC, which stands for Vendor Email Compromise. In Spanish we can translate it as business email commitment. E-mail is a widely used means of communication by companies and organizations and they generally trust that it is reliable. This makes it possible for cybercriminals to take advantage of it.
What a Phishing attack does is impersonate an identity to defraud. For example a social network, a platform to buy online, etc. However a business email compromise attack goes further. The attacker will impersonate the identity of a senior employee or someone important within a company.
For this to be possible, the cybercriminal will need a previous work. You will need to know that company very well, the functions that each employee performs, etc. Today many companies share information on the Internet, so it is something public and it does not cost them much work.
From there, the attacker create an email address with the name of that high-level employee. His mission is going to be to contact another worker of that organization and pretends to be his superior. A very common attack is that he is going to indicate that he needs to make an urgent bank transfer and gives a reason that may be credible.
The employee, for fear of having problems in the company with his superiors, will do what they are asked. The problem is logically it is a scam and that transfer goes to the attackers.
different variants
Once we know how a business email compromise attack works, it should be noted that there are different variants. Some are oriented towards providersothers against end sellers, etc. However, in all of them the objective is similar: pretend to be a relevant person and defraud a worker.
In this way they can obtain customer data, carry out sales or purchase scams, infect an entire business system, etc. All this can cause significant damage to the company and even damage its reputation with customers.
What can we do to avoid this type of problem? Undoubtedly the most important is the common sense. It is essential not to make mistakes, such as making a payment without confirming that it is really legitimate, downloading a file that may be dangerous, etc. You can always inform yourself in advance in case of doubts. It is essential to detect Phishing attacks.
In addition, in order to avoid security problems in the system, it will be essential to have a good antivirus and also have All updated. Some attacks will exploit vulnerabilities in a system. Therefore, installing security patches and updates can help prevent many problems.
