<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>War Room</title>
	<atom:link href="https://warroom.rsmus.com/category/business-email-compromise/feed/" rel="self" type="application/rss+xml" />
	<link>https://warroom.rsmus.com</link>
	<description>Shells From Above</description>
	<lastBuildDate>Thu, 15 Feb 2024 19:22:50 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://warroom.rsmus.com/wp-content/uploads/2018/09/cropped-favicon-32x32.png</url>
	<title>War Room</title>
	<link>https://warroom.rsmus.com</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>The Monarchy Lives On &#8211; BECs are alive and well</title>
		<link>https://warroom.rsmus.com/the-monarchy-lives-on-becs-are-alive-and-well/</link>
		
		<dc:creator><![CDATA[Sean Renshaw]]></dc:creator>
		<pubDate>Thu, 04 May 2023 16:54:09 +0000</pubDate>
				<category><![CDATA[Attack Vectors]]></category>
		<category><![CDATA[Business Email Compromise]]></category>
		<category><![CDATA[Forensics]]></category>
		<category><![CDATA[BEC]]></category>
		<category><![CDATA[Fraud]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=5997</guid>

					<description><![CDATA[For decades, fraudsters have attempted to separate people from their hard-earned money by purporting to be an exiled member of a royal family. Historically, this was done via phone calls and written letters to potential victims. Throughout the years, these “members” of the monarchy were able to successfully exploit peoples good will, and often greed, [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>Mass Mailing Attack from NOBELIUM</title>
		<link>https://warroom.rsmus.com/mass-mailing-attack-from-nobelium/</link>
		
		<dc:creator><![CDATA[Ken Smith]]></dc:creator>
		<pubDate>Tue, 01 Jun 2021 21:09:23 +0000</pubDate>
				<category><![CDATA[Business Email Compromise]]></category>
		<category><![CDATA[Defense]]></category>
		<category><![CDATA[Phishing]]></category>
		<category><![CDATA[ransomware]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=5449</guid>

					<description><![CDATA[On May 25, 2021, the campaign escalated as NOBELIUM, the same group behind the 2020 SolarWinds attacks, leveraged the legitimate mass-mailing service, Constant Contact, to masquerade as a US-based development organization and distribute malicious URLs to a wide variety of organizations and industry verticals. Using the legitimate mass mailing service Constant Contact, NOBELIUM attempted to [&#8230;]]]></description>
		
		
		
			</item>
		<item>
		<title>Microsoft Exchange &#8211; CVE-2021-26855+</title>
		<link>https://warroom.rsmus.com/microsoft-exchange-cve-2021-26855/</link>
		
		<dc:creator><![CDATA[RSM Author]]></dc:creator>
		<pubDate>Fri, 05 Mar 2021 19:19:54 +0000</pubDate>
				<category><![CDATA[Business Email Compromise]]></category>
		<category><![CDATA[Defense]]></category>
		<category><![CDATA[Forensics]]></category>
		<guid isPermaLink="false">https://warroom.rsmus.com/?p=5423</guid>

					<description><![CDATA[On March 2, 2021, Microsoft released several security updates to address at least seven critical vulnerabilities in supported versions of on-premise Microsoft Exchange Server. These vulnerabilities were observed being used in limited targeted attacks; however, due to the critical nature and publication of these vulnerabilities, Microsoft released guidance that all customers running on-premise versions of [&#8230;]]]></description>
		
		
		
			</item>
	</channel>
</rss>
