Phishing Infrastructure Attribution: Tracing a BEC Campaign to a Specific Threat Actor Group

Background

A company's accounts payable department wired $340K to a fraudulent bank account after receiving a convincing email that appeared to come from their CEO. The message mirrored the executive's tone and referenced a plausible, time-sensitive payment, and by the time the discrepancy surfaced, the funds had already been moved out of the initial receiving account. The engagement mattered because business email compromise rarely leaves an obvious trail: there is no malware to reverse-engineer and no single breached server to examine. What remains is a scatter of public artifacts — a look-alike domain, mail-routing metadata, and a downstream chain of accounts — that only becomes meaningful when it is assembled and cross-referenced against prior, documented activity.

Investigation Methodology

The review drew exclusively on publicly available and lawfully obtained records. No systems were accessed, and nothing about the sender was deanonymized.

1. Email header analysis. The phishing message's headers were examined for originating infrastructure — mail servers, relay hops, and the pass-or-fail results of standard authentication mechanisms — to establish where the mail plausibly originated rather than merely what the display name claimed.
2. Domain infrastructure mapping. The sender's look-alike domain was profiled through public registration records, WHOIS-style registrar data, passive DNS history, and hosting fingerprints, then pivoted to surface other domains sharing the same operational footprint.
3. Certificate and web-artifact review. Certificate transparency logs and the domain's SSL issuance chain were compared against certificates observed in previously reported campaigns.
4. Threat-actor correlation. The combined fingerprint was matched against documented BEC tactics, techniques, and procedures drawn from published industry threat reporting and our internal reference library.
5. Financial-chain review. The receiving account was checked against public and regulatory advisory references describing known money-mule networks.

Key Findings

• The phishing domain was registered through the same registrar and hosting provider used by a known West African BEC group tracked as "GOLD FOUNTAIN" in industry threat reports.
• The SSL certificate on the phishing domain was issued through the same certificate-authority chains observed in 14 previous BEC attacks attributed to this group — a recurrence more consistent with a reused operational playbook than with coincidence.
• The receiving bank account belonged to a network of money-mule accounts previously flagged by FinCEN.
• Of the original $340K, $220K was identified as still resting in downstream accounts where a freeze remained realistically possible.

Evidence and Sources

The conclusions rested on classes of public evidence rather than any single artifact: mail-transit metadata, public domain and registrar records, certificate transparency data, hosting and passive-DNS history, and published threat-intelligence write-ups describing the group's prior activity. Corroboration was deliberately multi-signal. A registrar match on its own is weak, but a registrar, a hosting pattern, and a certificate-issuance pattern all converging on the same documented actor — alongside a receiving account already named in a regulatory advisory — forms a far more defensible picture. Each linkage was recorded with its underlying source so that a reviewer could retrace it independently rather than take the conclusion on trust.

Limitations and Review Notes

Attribution here means correlation to a documented actor group's infrastructure and tradecraft, not the identification of a named individual, and it does not by itself prove who sat at the keyboard. Public records can be incomplete, deliberately obscured behind privacy services, or shared across unrelated tenants, so a human analyst reviewed every pivot before it was relied upon and discarded links that could not be independently supported. Registration and certificate patterns can be imitated, and timing means some downstream funds may already have moved beyond reach. Nothing in this review establishes intent for any third party, and none of it substitutes for the formal process that a law-enforcement referral triggers.

Outcome

The FBI's IC3 was provided with the full infrastructure analysis and the reconstructed bank-account chain. $220K was frozen and eventually recovered, and the mapped phishing infrastructure was taken down, reducing the exposure of other prospective targets. Because the analysis arrived as a corroborated, source-linked package rather than a raw tip, it informed the decision to pursue the freeze quickly while recovery was still feasible. Total investigation time: 3 weeks. Recovery: $220K of $340K.