CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Scripted Sparrow BEC Gang Sends Millions of Customized Emails Monthly

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A global business email compromise (BEC) gang, dubbed Scripted Sparrow, is sending 4-6 million highly targeted emails monthly. The group operates across three continents, using 119 domains, 245 webmail addresses, and 256 bank accounts. They pose as executive coaching firms, sending invoices and W-9 forms to Accounts Payable teams with spoofed reply chains. The group has been active since at least June 2024, with Fortra recording 496 unique engagements.

Timeline

  1. 22.12.2025 11:30 1 articles · 23h ago

    Scripted Sparrow BEC Gang Identified Sending Millions of Emails Monthly

    Security researchers have uncovered a global BEC gang, Scripted Sparrow, sending 4-6 million customized emails monthly. The group operates across three continents, using 119 domains, 245 webmail addresses, and 256 bank accounts. They pose as executive coaching firms, sending invoices and W-9 forms to Accounts Payable teams with spoofed reply chains. The group has been active since at least June 2024, with Fortra recording 496 unique engagements.

    Show sources
    Open in new tab

Information Snippets

  • Scripted Sparrow operates in at least five countries: Nigeria, South Africa, Türkiye, Canada, and the US.

    First reported: 22.12.2025 11:30
    1 source, 1 article
    Show sources

  • The group uses 119 domains and 245 webmail addresses, primarily through NameSilo and Dynadot registrars.

    First reported: 22.12.2025 11:30
    1 source, 1 article
    Show sources

  • They employ 256 bank accounts and use Windows computers running Remote Desktop Protocol (RDP) for interactions.

    First reported: 22.12.2025 11:30
    1 source, 1 article
    Show sources

  • The group sends emails with spoofed reply chains, often including PDF attachments like invoices and W-9 forms.

    First reported: 22.12.2025 11:30
    1 source, 1 article
    Show sources

  • Fortra estimates that for each message seen by their team, Scripted Sparrow likely sends 70,000 messages.

    First reported: 22.12.2025 11:30
    1 source, 1 article
    Show sources