In light of the failure at Silicon Valley Bank today, some good advice from Mitiga for organizations to be especially alert for BEC scams that seek to take advantage of investor and corporate anxiety over the safety of their assets:

“We are expecting a rise in BEC attacks taking advantage of the current situation. Please alert your finance team! In the next few days and weeks, many organizations are going to be changing their primary bank account, following the current situation in Silicon Valley Bank. This is especially relevant for SaaS vendors (and customers).

During this time, we are going to see many finance teams bombarded with account change requests and asks to urgently modify wire destinations. This havoc fuels attackers. It makes it much easier for attackers to launch business email compromise attacks, requesting account changes, which will be all processed as part of this situation, and taking advantage of confusion and chaos in the markets.

We strongly recommend you alert your finance teams to be extra careful with all inbound and outbound account change requests, and to reiterate the procedures you have for out of bound verification of new accounts.”

@briankrebs 2fa everything. like right now. yubikey if you can
@Viss @briankrebs most will be willing to accept stronger security and be more careful, except for the finance guys that keep a environment based around something sun microsystems developed in 2001 and runs on Microsoft Windows server 2008.
@m @Viss @briankrebs An awful lot of financial institutions consider SMS good TFA
@Viss @briankrebs how will MFA protect against someone spoofing an email asking to change payment details?
@briankrebs Bose-Einstein condensate attacks? Huh? Oh, business email compromise, I guess?
@dan131riley yes that phrase shows up in the toot.
@briankrebs ChatGPT er al. can come up with such plausible text, no typos or awkward wording, it will make this problem much worse.