Cybercriminal Gang Targeting SMBs Using Business Email Compromise

Todyl researchers describe a well-funded, operationally mature cybercriminal group conducting large-scale Business Email Compromise (BEC) campaigns against small and mid-market organizations across many industries. The actors have rapidly increased activity—responsible for about 65% of attempted BEC cases observed by Todyl at peak—leveraging pre-infected organizations and trusted proxy services (e.g., Cloudflare) to host phishing lures and bypass security controls, focusing on exploiting human trust rather than traditional malware.