Key Takeaways
- • Three institutional investors targeted: Kansas University endowment, Community Foundation of Texas, and hedge fund Arena Investors fell victim to a coordinated phishing campaign using malicious email tactics in late September and early October 2019.
- • Identical attack methodology: Fraudulent emails impersonating executives invited recipients to access "encrypted messages" via suspicious links designed to deploy malware or grant unauthorized account access to attackers.
- • High-value targets by design: Security experts confirm attackers are deliberately targeting institutional investors because of their access to millions in liquid capital and organizational reliance on wire transfer processes, creating significant financial exposure per breach.
- • Email compromise confirmed at nonprofits: Kansas University endowment vice president of investments Stacy Nuss and Community Foundation of Texas executives had email accounts breached, though Kansas endowment leadership confirmed no asset theft occurred in their case.
- • Arena Investors breach via COO impersonation: The hedge fund received malicious phishing emails sent from a spoofed chief operating officer address, extending the attack vector into the for-profit wealth management sector.
Summary
A coordinated cyber attack campaign targeting institutional investors has compromised email accounts at two major nonprofits and a hedge fund, according to reporting from late October 2019. The Kansas University endowment, Community Foundation of Texas, and hedge fund Arena Investors all fell victim to sophisticated phishing attacks designed to infiltrate executive email systems and potentially facilitate large-scale financial fraud.
The attack methodology was consistent across all three organizations. Fraudulent emails invited recipients to access encrypted messages by clicking embedded links, ostensibly leading to malware installation or account credential theft. At Kansas University, the attack specifically targeted Stacy Nuss, the endowment's vice president of investments, whose email account was compromised. A senior vice president at the endowment subsequently warned recipients about suspicious attachments and unknown links sent from Nuss's compromised address.
Security researchers identified the institutional investor sector as the deliberate target. "These organizations have access to millions of dollars in liquid accounts," Robert Capps of NuData Security told Institutional Investor. "Institutional folks managing capital are used to getting wire transfers and moving money. By targeting high-level executives in the financial industry, attackers are then able to send out wire transfer requests to someone in accounts payable, and then money is wired out to third parties. Make one mistake, and it could cost millions of dollars." This attack vector exploits both the financial accessibility of institutional accounts and organizational protocols around wire authorization.
Kansas University endowment leadership confirmed that no funds were stolen in the breach, with senior vice president James Clarke stating definitively that the organization did not lose money. However, both the endowment and Community Foundation of Texas acknowledged successful email account compromises among investment executives. Arena Investors experienced a parallel breach when attackers sent malicious phishing emails impersonating the hedge fund's chief operating officer, extending the attack campaign into the for-profit asset management space and signaling a broader institutional investor targeting strategy.
The attack methodology was consistent across all three organizations. Fraudulent emails invited recipients to access encrypted messages by clicking embedded links, ostensibly leading to malware installation or account credential theft. At Kansas University, the attack specifically targeted Stacy Nuss, the endowment's vice president of investments, whose email account was compromised. A senior vice president at the endowment subsequently warned recipients about suspicious attachments and unknown links sent from Nuss's compromised address.
Security researchers identified the institutional investor sector as the deliberate target. "These organizations have access to millions of dollars in liquid accounts," Robert Capps of NuData Security told Institutional Investor. "Institutional folks managing capital are used to getting wire transfers and moving money. By targeting high-level executives in the financial industry, attackers are then able to send out wire transfer requests to someone in accounts payable, and then money is wired out to third parties. Make one mistake, and it could cost millions of dollars." This attack vector exploits both the financial accessibility of institutional accounts and organizational protocols around wire authorization.
Kansas University endowment leadership confirmed that no funds were stolen in the breach, with senior vice president James Clarke stating definitively that the organization did not lose money. However, both the endowment and Community Foundation of Texas acknowledged successful email account compromises among investment executives. Arena Investors experienced a parallel breach when attackers sent malicious phishing emails impersonating the hedge fund's chief operating officer, extending the attack campaign into the for-profit asset management space and signaling a broader institutional investor targeting strategy.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.