As reported by BleepingComputer, Flare's recent research pulls back the curtain on Business Email Compromise (BEC) operations as they're discussed and coordinated on underground forums. What this research confirms — and what security teams must internalize — is that BEC has evolved well beyond the era of the poorly-worded CEO email. It is now a mature, compartmentalized criminal enterprise with its own economy, specializations, and operational security practices.

Key Takeaway: As reported by BleepingComputer, Flare's recent research pulls back the curtain on Business Email Compromise (BEC) operations as they're discussed and coordinated on underground forums.

BEC Is an Industry, Not an Attack

The framing of BEC as a "scam" fundamentally underestimates what organizations are actually defending against. Underground forums reveal a division of labor that mirrors legitimate business operations: initial access brokers selling compromised credentials, researchers identifying targets with large accounts payable volumes, social engineers crafting pretexts, and money mule networks executing the cash-out phase. Each participant is a specialist. Each role is replaceable.

This means that blocking one stage of the attack — say, flagging a suspicious wire transfer request — does not dismantle the threat. The operation simply reassigns the failed attempt and moves to the next target on the list. Defenders who think in terms of individual incidents are misaligned with how threat actors think in terms of campaigns and pipelines.

Why Finance and Legal Teams Are the Real Attack Surface

Security operations teams often focus their BEC defenses on email gateway controls and phishing simulations. But the actual exploitation point is increasingly a business process vulnerability, not a technical one. BEC operators conduct financial intelligence gathering — studying public filings, LinkedIn profiles, vendor relationships, and payment cycles — before a single malicious email is sent. By the time a CFO or accounts payable clerk receives a fraudulent wire instruction, the attacker already knows the vendor name, invoice cadence, and typical transaction amounts.

The most dangerous BEC attacks don't look like attacks at all. They look like routine business correspondence, because the attacker has done their homework.
This is a critical gap in many organizations' defenses: technical controls are applied to email infrastructure, but the business process workflows that govern fund transfers often lack equivalent scrutiny.

How Compromised Accounts Fuel the Pipeline

A significant portion of sophisticated BEC operations begin not with phishing but with credential theft and account takeover. Infostealer malware logs — widely traded on dark web marketplaces — provide attackers with authenticated session cookies and saved passwords that bypass MFA entirely. Once inside a legitimate inbox, a threat actor can monitor communications for weeks, learning internal terminology, relationships, and upcoming transactions before striking at the optimal moment.

This reconnaissance phase is where most organizations are completely blind. Email security tools that scan inbound messages for malicious links provide no visibility into an attacker who is simply reading and learning from a compromised mailbox.

Shield53 Recommendations

For Security Teams

How Compromised Accounts Fuel the Pipeline
Monitor for impossible travel and session anomalies in email platforms (Microsoft 365, Google Workspace). Authenticated access from unexpected geographies or device profiles should trigger immediate review, even when MFA was satisfied.
Deploy phishing-resistant MFA (FIDO2/passkeys) for all finance, legal, and executive accounts. SMS and authenticator app OTPs are insufficient against real-time phishing proxies and session hijacking.
Conduct dark web exposure monitoring for corporate email credentials and session tokens appearing in infostealer logs — this is now a baseline threat intelligence function, not a luxury.
Implement DMARC, DKIM, and SPF at enforcement (p=reject) for all sending domains, including legacy or subsidiary domains that attackers commonly spoof.

For Finance and Operations Leadership

  • Establish out-of-band verification protocols for any payment instruction changes — a phone call to a known number, never the contact information provided in the change request itself.
  • Limit public financial exposure: review what vendor relationships, payment cycles, and executive travel details are visible on company websites, LinkedIn, and press releases.
  • Run tabletop exercises that specifically simulate BEC scenarios with finance teams — not just IT. The people authorizing wire transfers need to be as practiced in recognizing manipulation as the SOC team is in detecting malware.

Broader Organizational Posture

  • Treat BEC incident response as a financial fraud investigation, not just a security event. Engage your bank's fraud department within minutes of a suspected fraudulent transfer — recovery windows are measured in hours.
  • Brief your cyber liability insurer on your BEC controls. Many policies have tightened coverage conditions specifically around social engineering losses, and demonstrating mature controls matters at claim time.

BEC losses continue to dwarf ransomware financially, yet it receives a fraction of the boardroom attention. Underground forum intelligence makes clear that organized criminal groups view this as a high-return, low-risk enterprise. The organizations that close that gap will be the ones that treat BEC as the structured adversarial operation it actually is — not an email problem to be solved with a spam filter.