Aging reporting used by scammers for Business Email Compromise

Aging reports are collections of outstanding invoices designed to help a company’s financial department to keep track of customers who haven’t yet paid for goods or services they bought on credit.

Researchers at Agari Cyber Intelligence Division (ACID) observed the new threat group impersonating a company’s CFO and requesting an updated aging report together with up to date contact information for each of the customers that had unpaid overdue invoices.

Not asking the company’s employees to change payment accounts is a tactic used by Ancient Tortoise to gain their trust and trick them into following up to their demands for company records. The attackers also made use of name deception and free email accounts designed to mimic the companie’s CFO to further strengthen their hoax.