Business Email Compromise underground operating model and monetization ecosystem
Threat Actor Meta
Summary
Hide ▲
Show ▼
BEC underground activity is expanding into a broader fraud-enablement ecosystem, raising the effectiveness and reach of invoice and payment fraud. Researchers observed actors combining mailbox/SaaS compromise, procurement mapping, call centers, and cash-out services to move stolen funds. Underground discussions from the past year also show rising use of AI-generated business correspondence and recruitment of mule support.
Related Happenings
BEC defensive guidance for exposed-credential and account-misuse risk
Defensive Guidance
H score14
First: 30.06.2026 17:00
Last: 30.06.2026 17:00
Sources 1
How related:
This allows organizations to detect when their access points appear in credential collections or search-service advertisements, prioritize the most relevant exposures, and respond faster with password resets, session revocation, MFA enforcement, and investigation of possible account misuse.
About this happening:
**BEC defenders** are being pushed toward tighter **training** and **account-response controls** as operators combine **AI-generated business correspondence**, **call-center press...
BEC defensive guidance for exposed-credential and account-misuse risk
Defensive GuidanceHow related: This allows organizations to detect when their access points appear in credential collections or search-service advertisements, prioritize the most relevant exposures, and respond faster with password resets, session revocation, MFA enforcement, and investigation of possible account misuse.
About this happening: **BEC defenders** are being pushed toward tighter **training** and **account-response controls** as operators combine **AI-generated business correspondence**, **call-center press...
Underground credential ecosystem shift changes threat-actor operations
Threat Actor Meta
H score69
First: 22.06.2026 17:05
Last: 22.06.2026 17:05
Sources 1
About this happening:
A **search-your-target** underground service layer is turning **stolen infostealer logs** into on-demand credentials, raising **account takeover** and **corporate intrusion** risk...
Underground credential ecosystem shift changes threat-actor operations
Threat Actor MetaAbout this happening: A **search-your-target** underground service layer is turning **stolen infostealer logs** into on-demand credentials, raising **account takeover** and **corporate intrusion** risk...
Underground sellers-fraud-oriented sellers alliance reshapes ransomware ecosystem operations
Threat Actor Meta
H score31
First: 25.03.2026 16:02
Last: 25.03.2026 16:02
Sources 1
About this happening:
A growing underground market for **premium AI platform access** is turning **ChatGPT**, **Claude**, **Microsoft Copilot**, and **Perplexity** access into a tradable black-market c...
Underground sellers-fraud-oriented sellers alliance reshapes ransomware ecosystem operations
Threat Actor MetaAbout this happening: A growing underground market for **premium AI platform access** is turning **ChatGPT**, **Claude**, **Microsoft Copilot**, and **Perplexity** access into a tradable black-market c...
Scattered Lapsus Shiny Hunters' harassment-driven extortion operating model
Threat Actor Meta
H score33
First: 02.02.2026 18:15
Last: 02.02.2026 18:15
Sources 1
About this happening:
**Scattered Lapsus Shiny Hunters (SLSH)** is now using a **harassment-driven extortion model** that pairs stolen data with swatting, threats, and publicity pressure, raising the s...
Scattered Lapsus Shiny Hunters' harassment-driven extortion operating model
Threat Actor MetaAbout this happening: **Scattered Lapsus Shiny Hunters (SLSH)** is now using a **harassment-driven extortion model** that pairs stolen data with swatting, threats, and publicity pressure, raising the s...
Timeline
-
30.06.2026 17:00 2 articles · 1h ago
Flare publishes analysis of the BEC underground operating model
Initial DisclosureFlare researchers analyzed underground BEC discussions from the past year and described BEC as an organized fraud operation built around mailbox or SaaS compromise, procurement-context reconnaissance, cash-out or mule networks, call centers, and AI-generated business correspondence. The analysis also highlighted interest in O365 and other SaaS accounts, the value of finance personnel mailboxes, and defensive monitoring of exposed credentials, corporate domains, login portals, SaaS applications, password resets, session revocation, and MFA enforcement.
Show sources
- Lessons from the Underground: How to Combat Business Email Compromise — www.bleepingcomputer.com — 30.06.2026 17:00
- Lessons from the Underground: How to Combat Business Email Compromise — www.bleepingcomputer.com — 30.06.2026 17:00