| The Federal Bureau of Investigation (FBI) and the Multi-State Information Sharing & Analysis Center (MS-ISAC) are releasing this Joint White Paper to raise awareness of cyber threat actors (CTAs) activity targeting vendor accounts within vendor portals belonging to US state, local, tribal, and territorial (SLTT) government or public entities, as well as school districts and higher-education institutions. |
| The FBI refers to these incidents as vendor account compromises (VACs). Since 2023, the FBI has recorded an uptick in the number of unique threat actor groups conducting VACs. This uptick appears to be in part due to CTAs’ increased awareness of the extent to which government and academic entities rely on online systems for conducting business and managing payment information. These CTAs use a mix of social engineering and exploitation of portal authentication measures to gain unauthorized access to vendor accounts, with the goal of manipulating vendor records and redirecting vendor payments. Increased cyber actor adoption of this scheme for stealing vendor payments poses an increased risk, as successful VACs can result in millions or tens of millions of lost dollars. |
| The FBI and MS-ISAC encourage organizations who use their own public-facing vendor portals, specifically federal and SLTT government entities, along with educational institutions, implement the recommendations in the mitigations section of this Joint White Paper to reduce the likelihood and impact of VAC incidents. The FBI and MS-ISAC also encourage these same organizations to educate both their information technology teams and finance and procurement teams on the VAC threat and the mitigations, as collaboration between these teams is integral to vendor portal security. |
| This Joint White Paper includes an overview of the VAC threat, a walkthrough of typical steps of VAC incidents, characteristics of VAC actors, and ways to mitigate the VAC threat. |