Orion S.A. $60M wire fraud (2024)

BEC operators targeting a public, SEC-reporting industrial company like Orion typically research the target's org chart, finance-team staff, and vendor or customer relationships using corporate websites, LinkedIn, press releases, and public filings, in order to identify a non-executive employee with wire-payment authority and to learn the names and communication style of the executives or vendors they could impersonate.

Consistent with typical BEC tradecraft, attackers likely registered look-alike domains or used spoofed or compromised email accounts resembling a trusted executive, vendor, or customer, and may have drawn on prior legitimate business correspondence, such as a compromised mailbox or an intercepted invoice, to make the impersonation and payment details more convincing.

The attacker or attackers contacted the targeted employee, described in Orion's filing only as a Company employee who is not a Named Executive Officer, posing as a senior executive, known vendor, or customer, using the urgent, authoritative tone consistent with classic BEC social engineering (per Proofpoint researcher Selena Larson's characterization of this case) to request a large, time-sensitive wire transfer.

Because the fraud involved multiple outbound wires rather than a single payment, the attacker or attackers likely maintained the pretext across repeated exchanges, reinforcing urgency and authority each time so the employee kept believing the payments were legitimate and routine, and avoiding anything that would trigger manual review.

Orion disclosed a material weakness over its control over manual wire transfers, stating that while it believed the controls as designed were adequate to prevent or detect unauthorized wire transfers, the control did not operate effectively to safeguard company assets. The failure was in operation, not in design, which is the more instructive lesson: the controls existed and the scheme got past them anyway, with no technical intrusion ever occurring.

Wired funds landed in accounts controlled by unknown third parties. Consistent with typical BEC money-mule patterns, proceeds in schemes like this are usually moved quickly through intermediary or exchange accounts to frustrate bank recall and law-enforcement freeze requests before the victim organization discovers the fraud, completing the attacker's financial objective; Orion has not disclosed recovery, arrests, or attribution.