Cybercriminals Trick Tenants into Sending Rent to Fraudulent Accounts

Proofpoint, a leading cybersecurity firm, has identified and named a new financially motivated Business Email Compromise (BEC) threat actor, dubbed TA2900, actively targeting individuals in France and occasionally Canada.

This actor employs sophisticated social engineering tactics, sending French-language emails centered around rental payment scams to deceive victims into transferring funds to attacker-controlled accounts.

These campaigns typically involve messages claiming that a rental installment for the recipient’s property has not been received, urging immediate payment to a new bank account provided via International Bank Account Number (IBAN) details.

According to the Report, Proofpoint researchers have tracked nearly two dozen unique IBANs across more than 50 campaigns, noting that the actor frequently switches accounts after two to three uses to evade detection.

Sophisticated Tactics and Social Engineering Exploits

TA2900’s emails often originate from compromised mailboxes, primarily from educational institutions worldwide, adding a veneer of legitimacy to their fraudulent communications.

Subject ...