What We Do
How we do it
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
Mar 15, 2023
CVE-2023-23397 - Microsoft Outlook Elevation of Privilege Zero-Day Vulnerability
THE THREAT On March 14th, as part of Microsoft’s monthly Patch Tuesday release, the company disclosed a critical, actively exploited vulnerability impacting Microsoft Office and Outlook. The…
Read More
View all Advisories →
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
Mar 20, 2023
Exertis and eSentire Partner to Deliver 24/7 Multi-Signal MDR, Digital Forensics & IR Services and Exposure Management to Organisations Across the UK, Ireland, and Europe
Basingstoke, UK– 20 March, 2023. Leading technology distributor, Exertis, announced today that it has bolstered its cybersecurity services, adding eSentire, the Authority in Managed Detection and Response (MDR), to its Enterprise portfolio of offerings. eSentire’s award-winning, 24/7 multi-signal MDR, Digital Forensics & Incident Response (IR), and Exposure Management services will be available…
Read More
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Blog — Mar 16, 2023

How Cybercriminals Can Exploit Silicon Valley Bank's Collapse for Phishing Attacks

3 minutes read
Speak With A Security Expert Now

In the span of one week, countless businesses within the tech industry have been impacted by the collapse of Silicon Valley Bank (SVB), an event which is now regarded as the second-largest bank failures in history. Shortly thereafter, New York-based Signature Bank also failed.

Given the scale of the collapse and the potential for a banking crisis, the US government has stepped in and reassured all SVB clients that their deposits within SVB, even those greater than $250,000 USD.

While the many start-ups and that were impacted are focused on gaining access to their funds for payroll administration and fulfillment of contractual obligations with their third-party partners to prevent business disruption, it’s important that security leaders also pay attention to what this situation represents for threat actors: a golden opportunity to take advantage of vulnerable businesses and their employees.

Threat actors are widely known to take advantage of major black swan events – natural disasters, global pandemics, and geopolitical tensions – to manipulate their victims into falling for a phishing or business email compromise (BEC) scam.

In fact, eSentire’s Threat Response Unit (TRU) noted that email was used as an initial access vector for 66% of all incidents we saw in customer environments. Although its use decreased in 2021, we saw a resurgence of email-based malicious code (“malcode”) coming out of 2022. 

There’s no doubt that cybercriminals have perfected the art of creating emails that not only mimic the layout design used by their target organizations but mirroring the sender’s language too. This helps to convince their target that the message is from a trustworthy source, like a bank, healthcare organization, government department, or even a friend.

What’s more, threat actors are also relying on social engineering tactics like email thread hijacking, in which the threat actor inserts their malicious emails within legitimate email threads obtained by exfiltrating the mailboxes from compromised hosts. Since the email was formerly part of a legitimate conversation, it is much less likely to arouse suspicion.

This tactic has been observed on several occasions to deliver information stealing malware like Qakbot and SQUIRRELWAFFLE.

In the case of the SVB collapse, TRU believes that threat actors may use this opportunity to target your business, customers, and partners with payment/refund scams, wire fraud scams, or credential phishing attacks. With every company impacted by the SVB collapse in the process of reaching out to customers, partners and vendors to update banking and payment information, all of us are particularly vulnerable to these tactics right now.

Security Recommendations from eSentire Threat Response Unit (TRU)

Just because your business may not bank with Silicon Valley Bank doesn’t mean you won’t be a target. Cybercriminals are known to take advantage of third-party relationships and indirectly target their victims so if your customers or third-party partners have been impacted, you may inadvertently become a target as well.

If the SVB incident impacts your business, it’s likely that clients will reach out to ask what your exposure is, and where to re-direct funds to. Therefore, we recommend:

eSentire’s Threat Response Unit (TRU) has also provided additional security recommendations in their security advisory.

To learn how eSentire can help your organization build resilience and prevent business disruption, connect with an eSentire cybersecurity specialist.

View Most Recent Blogs

eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.