Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

FBI Warns of BEC Scammers Impersonating Construction Companies

FBI Warns of BEC Scammers Impersonating Construction Companies

The Federal Bureau of Investigation (FBI) warned private sector companies of scammers impersonating construction companies in business email compromise (BEC) attacks targeting organizations from multiple US critical infrastructure sectors.

BEC scammers use various tactics (including social engineering and phishing) to compromise or impersonate business email accounts with the end goal of redirecting pending or future payments to bank accounts under their control.

The warning was issued via a TLP:GREEN Private Industry Notification (PIN) sent to organizations today to help cybersecurity professionals defend against these active attacks.

According to the FBI, threat actors exploit construction companies’ ongoing, completed, or awarded business relations to defraud their private and public sector clients.

BEC campaign started in March

The incidents are part of a campaign that started in March 2021 and has already resulted in financial losses ranging from hundreds of thousands to millions of dollars.

To successfully pull off these BEC attacks, the scammers use information collected via online services on construction companies they impersonate and the customers they’re targeting.

Also Read: The DNC Registry Singapore: 5 Things You Must Know

Platforms used for harvesting valuable data (e.g., contact info, bid data, and project costs) include local and state government budget data portals, as well as subscription-based construction industry data aggregators.

The information harvested by the attackers allows them to custom-tailor emails designed to exploit the business relationship between the victim and the construction contractors.

To make the messages more convincing, the scammers send emails asking the targets to change direct deposit account and automated clearing house (ACH) information. The new account info points to bank accounts under the fraudsters’ control.

These emails are sent using domains spoofing the contractors’ legitimate sites and legitimate company logos and graphics to increase the chance that the victims will not be able to tell that the messages are fraudulent.

Almost $2 billion lost to BEC scams in 2020

In March, the FBI also warned of another series of BEC attacks increasingly targeting US state, local, tribal, and territorial (SLTT) government entities, with losses ranging from $10,000 up to $4 million between November 2018 and September 2020.

Last month, Microsoft detected a large-scale BEC campaign that targeted over 120 organizations using typo-squatted domains registered a few days before the attacks started.

FBI’s 2020 annual report on cybercrime affecting US victims listed a record number of complaints and financial losses last year.

“The FBI’s Internet Crime Complaint Center (IC3) notes BEC is an increasing and constantly evolving threat as criminal actors become more sophisticated and adapt to current events,” the FBI said.

“There was a 5 percent increase in adjusted losses from 2019 to 2020, with over $1.7 billion adjusted losses reported to IC3 in 2019 and over $1.8 billion adjusted losses reported in 2020.”

Also Read: How to Comply with PDPA: A Checklist for Businesses

In other alerts issued last year, the FBI warned of BEC scammers exploiting email auto-forwarding and cloud email services such as Microsoft Office 365 and Google G Suite in their attacks.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us