london-blue-april-2019.pdf

Agari ACID's April 2019 update on 'London Blue' documents a UK-based BEC criminal enterprise that harvested large lead databases (~8,500 financial executives), evolved from generic impostor accounts to spoofing CEO domains, targeted Asia-based employees of Western firms, conducted wire-fraud style scams (M&A-themed), and provides associated attacker email IOCs and observed TTPs.