Full Report
The Federal Bureau of Investigation (FBI) warns that criminals are impersonating U.S. officials in phishing attacks targeting businesses and individuals who request city and county planning and zoning permits. [...]
Analysis Summary
# Tool/Technique: Government Impersonation (Planning & Zoning Phishing)
## Overview
This technique involves a social engineering and phishing campaign where threat actors impersonate U.S. city and county planning and zoning officials. The goal is to defraud businesses and individuals who have active land-use permit applications by requesting fraudulent fees through wire transfers, peer-to-peer (P2P) payments, or cryptocurrency.
## Technical Details
- **Type**: Social Engineering / Phishing / Business Email Compromise (BEC) variant
- **Platform**: Cross-platform (Email/Web-based)
- **Capabilities**: Credential/Information harvesting, financial fraud via fraudulent invoicing.
- **First Seen**: March 2026 (Reported by FBI)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1566.002 - Phishing: Spearphishing Link** (Linking to payment portals)
- **T1566.003 - Phishing: Spearphishing Attachment** (Fraudulent invoices)
- **TA0007 - Discovery**
- **T1593.002 - Search Open Technical Databases** (Publicly available zoning and permit databases)
- **T1589.002 - Gather Victim Identity Information: Public Records**
- **TA0042 - Resource Development**
- **T1585.002 - Establish Accounts: Email Accounts** (Creation of look-alike or non-gov domains)
## Functionality
### Core Capabilities
- **Targeted Open Source Intelligence (OSINT):** Actors scrape public records for permit/zoning application numbers, property addresses, and business names to increase the credibility of the lure.
- **Financial Fraud:** Generation of fraudulent invoices that mimic official government branding.
- **Urgency Manipulation:** Use of "delays in permit processing" as a catalyst to bypass standard financial verification procedures.
### Advanced Features
- **Temporal Alignment:** Threat actors time their phishing attempts to coincide with actual hearing dates or project milestones found in public records.
- **Digital Payment Diversion:** Shifting payment from traditional government channels to harder-to-track methods like P2P apps and cryptocurrency.
## Indicators of Compromise
- **File Names:** `Invoice_[Permit_Number].pdf`, `Zoning_Fee_Notice.pdf`
- **Network Indicators:**
- `usa[.]com` (Unauthorized domain used for impersonation)
- Generic freemails (Gmail, Yahoo) disguised with "Official" display names.
- **Behavioral Indicators:**
- Unsolicited requests for payment via wire transfer, cryptocurrency, or P2P apps (Zelle, Venmo).
- Emails containing PDF attachments that instruct the user to email a different address for "further instructions."
## Associated Threat Actors
- **Unattributed:** Currently identified as generalized cybercriminals; however, the methodology aligns with **Business Email Compromise (BEC)** groups.
## Detection Methods
- **Domain Verification:** Check for discrepancies between the sender's domain and the official city/county domain (e.g., `.com` vs. `.gov`).
- **Keyword Monitoring:** Flagging emails containing "zoning permit," "planning board," and "cryptocurrency" or "wire transfer" in the same thread.
- **DMARC/SPF/DKIM:** Implementation of strict email authentication to prevent direct spoofing of local government domains.
## Mitigation Strategies
- **Verification Protocols:** Always verify outstanding fees by calling the government agency directly using a phone number from an official government (.gov) website.
- **Multi-Factor Authentication (MFA):** Secure all business communication accounts to prevent account takeover.
- **Public Record Awareness:** Be aware that information submitted in permit applications is public and can be used to craft highly targeted lures.
- **User Training:** Educate employees and applicants on the signs of spearphishing and the specific fact that U.S. officials do not request P2P or cryptocurrency payments.
## Related Tools/Techniques
- **Phishing: Voice Phishing (Vishing):** Previously used by actors impersonating law enforcement.
- **Deepfake Audio:** AI-generated voices used to impersonate U.S. officials in related fraud schemes.
- **BEC (Business Email Compromise):** The broader category of financial fraud involving impersonation of trusted entities.