Most attacks rely on some form of social engineering to exploit human curiosity, desire, fear, enthusiasm, and urgency.
Cybercrime is becoming more and more threatening, and attack methods are evolving day by day. As at the core of almost every successful cyberattack, one remains unchanged. It is to persuade the victim to take the desired action. Clever cyber attackers, such as clicking links, opening attachments, and responding to requests, employ clever social engineering tactics that exploit human curiosity, desire, fear, enthusiasm, and urgency. Most attacks rely on some form of social engineering to carry out. Let’s take a look at the top 5 social engineering trends to watch in 2021.
1. Rising consent phishing
Since Covid19, more and more companies are migrating their workloads to the cloud, and attackers are developing advanced ways to hijack data stored in the cloud. So-called “consent phishing” is one such variant of social engineering, using malicious apps that ask users for permission (instead of asking for a password) to gain legitimate access to cloud services and applications. Allow. Such apps can easily bypass endpoint security because they don’t have to run code on the user’s computer. Authentication technologies such as OAuth 2.0 are currently used by many major companies such as Microsoft, Google and Facebook. The SANS Institute attack is one such recent example, where a malicious Office 365 add-on automatically forwarded an employee’s email account to a cybercriminal’s email address. Since then, this has compromised 28,000 personally identifiable records.
2. Business Email Infringement Is More Expensive
FBI considers Business Email Infringement (BEC), also known as Email Account Infringement, to be one of the most damaging online financial crimes. This is another social engineering attack in which cybercriminals pretend to be trusted business contacts. Cybercriminals disguise themselves as trusted entities and persuade targets to provide invoice payments, remittances, or access to data and intellectual property. Currently, the average cost of a BEC attack is estimated at $ 80,000 and is estimated to increase each year. In 2019, a Lithuanian attacker disguised as a hardware vendor tricked Google and Facebook into sending $ 123 million to a bank account. According to Gartner, BEC attacks will double each year until 2023, costing victims a staggering $ 5 billion.
3. Deepfake creates deeper challenges
Social media enthusiasts use deepfake video as a form of entertainment, but hackers and cybercriminals use it to manipulate information, destroy credibility, and trust. We see it as an opportunity to pretend to be a possible source of information. Although the true impact of deepfake has not yet been measured, the technology is so powerful that it can be used to social engineer fake messages sent to fraudulent businesses. Nation-state attackers can create fake viral videos of politicians, disinformation, manipulate emotions, incite anger and hatred, and even overthrow the government. Experts have recently ranked deepfake technology as the most worrying use of artificial intelligence that can have a serious impact on cybercrime and terrorism.
4. Nation-state attackers armed with social engineering
Data is new oil, which is why rogue nations are constantly increasing their stake in cyberwarfare. Whether stealing Covid19 research or uncovering high-value targets, state-sponsored attacks are on the rise. Between July 2019 and June 2020, Microsoft reportedly sent 13,000 notices warning account owners about government-sponsored attacks. Google’s threat analysis group recently identified a North Korean hacker disguised as a cybersecurity blogger targeting LinkedIn and Twitter security researchers. In 2020, Twitter employees faced a collaborative social engineering attack that allowed state-sponsored attackers to control the hottest accounts and tweet on their behalf. It is estimated that approximately 12% of all attacks on industrial control systems (ICS) are from national attackers.
5. Phishing service market expansion
From ransomware attacks to malware infections caused by users clicking on fake URLs, fake websites and malicious attachments, phishing is one of the most common and powerful forms of social engineering attacks. The growth of Phishing as a Service has significantly reduced the level of people trying to get involved in cybercrime. Similar to the Software as a Service (SaaS) model, where consumers access cloud-based applications with monthly or annual subscriptions, phishing toolkits can be rented from organized crime syndicates and mainstream hackers for just $ 50 per month. In fact, phishing kit sales increased 120% in 2019, and the average price of one of these kits has more than doubled due to high demand.
At the beginning of 2021, a new cybercrime tool called LogoKit that can create phishing pages in real time was introduced and has already been detected in more than 700 domains.
User awareness is no longer an option-it’s a strategic requirement
It’s clear that attackers are designing social engineering attacks. Social engineering attacks are compelling and successful day by day. More than ever, it’s important for users to stay vigilant and trust nothing at face value. Studies show that when users are trained in security awareness, develop muscle memory and discover danger signs and security anomalies, the likelihood of social engineering attacks is greatly reduced. The minefields of social engineering are vast, and the most effective way for organizations to achieve cyber resilience is to build and maintain a culture of cybersecurity.