Ongoing Executive Impersonation Attack

Question

A friend of mine runs a small business that was recently targeted by a relatively sophisticated "executive impersonation" wire transfer spearphishing attack. The attacker registered a domain that was a slight variant to the target company's that was visually similar, and spoofed a convincing E-mail to the company's finance department requesting a wire transfer to a provided bank account. The domain name is registered through Google, whois information is anonymized through a proxy, and the E-mail was sent using the Google Apps' Gmail web interface.

Fortunately, the company's security policies were robust enough to catch the fraud before any funds were transferred. One of the details about this incident that seems odd based upon what I've read about similar attacks is that the bank account was based in the United States, and is associated with a domestic address near the bank.

The relevant authorities were notified, including the bank, Google, the whois proxy service, police local to the target company, police local to the bank, the FBI, and DHS. The police local to the bank seemed mildly interested, and actually visited the address associated with the account, but no one was there. Among the other authorities, either they have yet to respond or they are uninterested in helping, since no actual money was transferred/lost. The dollar amount was also relatively small for fraud like this (low five figures).

As of the time of this posting, the attackers are still being strung along and believe that the wire transfer will occur.

I have two questions:

1. Is it typical for these attacks to be associated with domestic US bank accounts? Does that imply that the attacker is also domestic?
2. Given that the attackers are still actively engaged, and assuming the authorities are unwilling to investigate, is there anything that can be done to reveal more information about the attackers? I realize that 419-style scam baiting probably won't work for a situation like this, and vigilantism is unadvisable, especially if the attackers are domestic. But perhaps there is something relatively passive that could be done to help catch the attackers?

Update: One of the federal agencies finally expressed some interest and started guiding the ongoing communication with the attackers.

Answer 1

First off: notifying the police and three letter agencies that are responsible is exactly the right thing to do.

To your questions:

1. Not quite. But that does not mean that the attacker is US-based or that it's the attacker's bank account.

   For all that matters, it could be the bank account of someone previously fished that has no relevant balance.

   Using that as the destination for a wire transfer scam is tricky: it covers the attacker's identity and adds a false sense of security, as the destination account is with a US bank rather than some shady off shore bank.

2. No. Please just leave that to your government and the law enforcement agencies. Cross reference this question and its answers.

Answer 2

1. Most likely they are using moneymules. These are people who are used to transfer the money. Sometimes it's a breached account as well as foreign transfers may raise eye brows (often the money is later siphoned to other countries afterwards)
2. It's just a question if they are domestic, this is not sure. Leave it to the authorities and consult legal counsel.