This presentation is hosted by a chemical company and a team of the Dutch police. We showcase an ongoing crime where cybersecurity and physical crime blend, in the world of Rotterdam’s oil and chemical storage. It starts with the tracking of a very persistent threat actor who uses domain typosquatting and near perfect BEC fraud — into a much more advanced and wider circle of digital and financial infrastructure, where eventually the threat actor breaches even physical boundaries. The collaboration between the ISAC Oil & Chemicals and the team of the Dutch port police has shown that the crime has reached a financial impact higher than most ransomware attacks, without the spotlight on them, yet.