THE THREAT
On Wednesday, March 8, 2023, Silicon Valley Bank (SVB) announced it sold securities in response to a liquidity crisis. This set off a chain of events where SVB clients were advised by third-party advisors to withdraw funds from SVB. These clients then attempted to withdraw their funds, causing a run on the bank. On March 12, 2023, state regulators also closed New York based Signature Bank. The current situation has stabilized with the announcement by the US Treasury & FDIC on March 12 that depositors would be fully protected.
eSentire Threat Intelligence assesses the chances are almost certain that threat actors will leverage this crisis to attempt phishing and Business Email Compromise (BEC) campaigns.
What we’re doing about it
- eSentire Threat Intelligence is conducting threat sweeps for suspected malicious domains and IP addresses associated with this threat.
- eSentire security teams continue to track this ongoing topic.
How To Stay Safe
- These events will usher a number of legitimate requests to change payment coordinates with vendors, suppliers, and partners.
- eSentire Threat Intelligence assesses the chances are almost certain that threat actors will leverage this crisis to further various fraud schemes including Business Email Compromise (BEC), refund/payout related scams and credential phishing attacks.
- Extra diligence surrounding any change of payment information is strongly recommended. This includes out-of-band communications with verified company payee representatives to validate payment requests during this time. Additional recommendations for BEC can be found here [6].
- Ensure finance department employees are appropriately aware of the increased risk and adhere to standard policies and procedures for handling payment change requests.
- Be especially wary of emails using keywords such as ‘Invoice’, ‘Payment’, ‘Refund’, ‘Settlement’ or ‘Payout’ in the subject line or message content. Additional vigilance is recommended for any communication purporting to be from Silicon Valley Bank, FDIC, or similar authorities.
- Confirm endpoint detection and response technology are deployed across all endpoints.
- Ensure standard procedures are in place for employees to submit potentially malicious content for review.
How Threat Actors May Abuse This
- Threat actors will attempt to use this crisis as an opportunity to craft phishing emails disguised as payment information.
- Be wary of emails with keywords such as ‘Invoice’, ‘Payment’, ‘Refund’, ‘Settlement’ or ‘Payout’ in the subject line or message content as these emails could contain phishing links or documents containing malware loaders disguised as Invoices or Payment information.
- Attackers may attempt to impersonate clients or partners requesting updated payment information.
Additional information
On March 10, 2023, Silicon Valley Bank (SVB) was closed by regulators because of a liquidity crisis. The bank held many Treasuries and other government bonds; amounting to over half of its assets. As interest rates rose, those bonds became less valuable, and the bank needed to sell these assets at a loss to meet the liquidity needs of depositors. This resulted in SVB filing a press release on March 8 indicating it had sold $21 Billion in assets to raise funds. The March 8 filing resulted in SVB shares sharply declining on Thursday March 9 and is believed to have sparked panic among tech investors and company founders, who encouraged start-ups to withdraw their money. [1, 2, 3]
On March 12, 2023, state regulators also closed New York based Signature Bank. Federal Deposit Insurance Corporation (FDIC) took control of Signature, which had $110 Billion in assets and $88 Billion in deposits at the end of last year, according to New York state's Department of Financial Services.
On March 12, 2023, the U.S. Department of Treasury issued a joint statement with the Federal Reserve and the Federal Deposit Insurance Corporation (FDIC). The statement indicated that “Depositors will have access to all of their money starting Monday, March 13.” and stated that “it will make available additional funding to eligible depository institutions to help assure banks have the ability to meet the needs of all their depositors.” [5]
What’s expected?
If the SVB incident impacts your business, it is likely that clients will reach out to ask what your exposure is, and where to re-direct funds to.
For those in sales teams, you should ensure that you monitor any account change notifications from your customers and carefully review each of them.
Additionally, for those in financial teams, it is worth setting up monitoring to check every receivable account change after it has been changed. Ideally, your finance platform should be able to create a daily report, which should then be reviewed by an individual that is not the person responsible for the actual changes.
Also, consider adding a policy that does not allow for the transfer of funds to accounts recently modified. This will give enough time for the vendor or the auditor to notice it before any money has been wired.
Indicators of Compromise |
svb-usdc.com | Domain |
svbfailure.com | Domain |
svb-circle.com | Domain |
References:
[1] https://www.washingtonpost.com/business/2023/03/10/svb-collapse/
[2] https://www.bloomberg.com/news/articles/2023-03-12/us-moves-to-help-depositors-offer-bank-backstop-in-wake-of-svb?leadSource=uverify%20wall
[3] https://ir.svb.com/news-and-research/news/news-details/2023/SVB-Financial-Group-Announces-Proposed-Offerings-of-Common-Stock-and-Mandatory-Convertible-Preferred-Stock/default.aspx
[4] https://www.reuters.com/business/finance/new-york-state-regulators-close-signature-bank-2023-03-12/
[5] https://home.treasury.gov/news/press-releases/jy1337
[6] https://www.cisecurity.org/insights/white-papers/security-primer-business-email-compromise
