Scattered Canary is a BEC group laundering funds through romance scam mule networks.
Analyst brief
Scattered Canary is a group that evolved from an individual scammer into a business email compromise (BEC) operation. They target enterprises, leveraging a network of mules recruited through romance scams to launder stolen funds. Their primary TTP is BEC, though they built their expertise on Craigslist and romance scams. Defenders should focus on detecting fraudulent emails targeting finance departments, especially those requesting urgent payments and exhibiting spoofing indicators.
Scattered Canary
unknown
When the first member of Scattered Canary, who, for the purposes of this report, we call
Alpha, began his operations, he was a lone wolf—working mostly Craigslist scams as he learned
the tricks of the trade from a mentor. However, within a few years, he had honed his craft
enough to expand into romance scams, where he met his first “employee,” Beta. Once they
had secured enough mules via their romance scams to launder their stolen money, they shifted
from targeting individuals to targeting enterprises, and the group’s BEC operation was born.