A friend of mine runs a small business that was recently targeted by a relatively sophisticated "executive impersonation" wire transfer spearphishing attack. The attacker registered a domain that was a slight variant to the target company's that was visually similar, and spoofed a convincing E-mail to the company's finance department requesting a wire transfer to a provided bank account. The domain name is registered through Google, whois information is anonymized through a proxy, and the E-mail was sent using the Google Apps' Gmail web interface.
Fortunately, the company's security policies were robust enough to catch the fraud before any funds were transferred. One of the details about this incident that seems odd based upon what I've read about similar attacks is that the bank account was based in the United States, and is associated with a domestic address near the bank.
The relevant authorities were notified, including the bank, Google, the whois proxy service, police local to the target company, police local to the bank, the FBI, and DHS. The police local to the bank seemed mildly interested, and actually visited the address associated with the account, but no one was there. Among the other authorities, either they have yet to respond or they are uninterested in helping, since no actual money was transferred/lost. The dollar amount was also relatively small for fraud like this (low five figures).
As of the time of this posting, the attackers are still being strung along and believe that the wire transfer will occur.
I have two questions:
- Is it typical for these attacks to be associated with domestic US bank accounts? Does that imply that the attacker is also domestic?
- Given that the attackers are still actively engaged, and assuming the authorities are unwilling to investigate, is there anything that can be done to reveal more information about the attackers? I realize that 419-style scam baiting probably won't work for a situation like this, and vigilantism is unadvisable, especially if the attackers are domestic. But perhaps there is something relatively passive that could be done to help catch the attackers?
Update: One of the federal agencies finally expressed some interest and started guiding the ongoing communication with the attackers.