Cyber attack Trends
Trend #1: Use of AI
One of the defining features of 2023 was the rapid rise of artificial intelligence (AI) in cyber security. ChatGPT had a public launch in the final few months of 2023 and was seen as groundbreaking and unique. Within a few months, there were hundreds or thousands of new tools and projects applying generative AI and large language models (LLMs) to a variety of different tasks.
In the cybersecurity space, generative AI has numerous potential applications. These tools have already been applied to dramatically increase the quality of social engineering attacks and develop novel malware, including infostealers, keyloggers, and ransomware.
While companies such as OpenAI have attempted to build defenses into their tools, they have met with limited success. Research has demonstrated that these restrictions can be easily bypassed, allowing cybercriminals to leverage these tools to increase the scale and sophistication of their attacks.
Trend #2: Ransomware
Ransomware remained the biggest form of cyber attack in 2024. While the number of ransomware attacks increased, the median payment remained roughly the same, $200,000.
A significant change in the ransomware during 2024 was some key law enforcement successes, particularly the downfall of two major players LockBit and ALPHV. Both required sustained and coordinated international efforts with intelligence sharing to jointly pursue ransomware-as-a-service (RaaS) groups and their infrastructure.
But, the removal of two large groups only had a short-term impact. The number of known ransomware victims in 2024 still increased, with the pipeline for attacks intact and thriving.
Another trend saw organizations less willing to pay ransoms. This is due to repeated examples of groups failing to decrypt data after the ransom was paid and enhanced data backup procedures helping increase organizational resilience to the attack vector.
- Data found that the share of encryption-based cases where a ransom was paid dropped from 75% in 2019 to 32% in Q3 of 2024.
Trend #3: Growth of Infostealer
Infostealer attacks increased by 58% in 2024. While the technology remains mostly the same, the industry around infostealers has matured significantly. Sensitive information obtained through infostealers has become easy to find on the dark web with Malware-as-a-Service (MaaS) platforms buying and trading the latest logs,
Initial Access Brokers (IABs) also use new logs to get a foothold in networks, proving the value of infostealer data for resale on the dark web. This lets threat actors select specific targets depending on their goals.
Money generated from these sales further fuels the infostealer ecosystem and its surrounding infrastructure.
Trend #4 Cyber Wars and Disinformation
State-sponsored cyber attacks and disinformation campaigns saw significant growth in 2024.
Much of this was driven by the integration of AI technologies, which were utilized in at least a third of elections between September 2023 and February 2024, either by a candidate or foreign actors.
High-Profile Election Disinformation Campaigns
High-profile instances of disinformation campaigns targeting the 2024 elections include the US primary and presidential elections. The US primary election, where deep fake videos of politicians were widely distributed on X (formerly Twitter) and amplified further by bots.
The US Presidential election was targeted by Iranian cyber attacks via “hack and leak” operations targeting:
- journalists
- Lobbyists
- Activists
Plus, suspected Chinese-aligned actors utilized deepfake technology to discredit candidates.
Regulatory Responses to Disinformation and Cyber Attacks
In response to the growing number of state-sponsored cyber attacks and disinformation campaigns targeting democratic elections, Western powers have begun tightening regulations. This includes:
- Canada expanding the Canadian Security Intelligence Service Actor for improved sharing of intelligence
- The EU introducing stricter rules on social media platforms to help mitigate Russian disinformation
Types of Cyber Attacks
While cyber attack types are typically defined by the method used to gain unauthorized access or disrupt systems, they also vary based on:
- Motive: Financial gain, political reasons, personal motivation, etc.
- Threat Actor: Insider or an outsider threat, individual attacker, cyber crime groups, state-sponsored actors, etc.
- System Targeted: Customer data, payment systems, financial data, intellectual property, account credentials, etc.
The specific attack vectors or methods threat actors utilize are evolving in response to new cybersecurity strategies. Plus, new multi-vector attacks offer advanced entry points by combining different methods. The most common attack vectors you need to know are discussed below.
#1: Malware
Malware, or malicious software, is a broad term for programs that are intentionally designed to damage computer, network, or server operations. This could be through:
- Taking control of system functionality
- Preventing operations
- Gaining unauthorized access to steal or remove data
Malware threats typically reproduce to spread across connected systems, giving the attacker further access to do more damage. It can be delivered in multiple ways, including phishing and software vulnerabilities. It can also facilitate many other attacks such as ransomware and Distributed Denial of Service (DDoS).
Common malware threats include:
- Trojan Horse: Tricking users into installing malware disguised as a legitimate program.
- Spyware: Malware that covertly runs on the user’s system to obtain sensitive data such as login credentials or financial information.
- Scareware: Scaring victims into downloading malware using fake messages about the risks they face. This includes false cyber attack messaging that convinces a user to download malware disguised as antivirus software.
- Worms: Replicating code with the primary purpose of spreading between systems to increase the attacker’s access and control within a network.
- Infostealer: Infiltrates systems to steal sensitive data, primarily targeting login credentials and financial information.
#2: Ransomware
Ransomware attacks are a form of malware that infiltrates corporate networks or personal computers to encrypt data or lock users out of their own systems. The attacker withholds the data or system access, asking the victim to pay a ransom in exchange for regaining access.
This fee is commonly demanded in cryptocurrency to disguise the attacker’s identity while they receive funds.
#3: Phishing
A phishing attack is a type of social engineering attack that tricks the victim into downloading malware or revealing sensitive information like login credentials or credit card information. Social engineering attacks target users by actively deceiving them to induce a specific action rather than utilizing any form of technical “hacking” knowledge.
Phishing attacks send victims fake communications that appear to be real and from a reputable source.
These communications are commonly sent via email but can leverage other channels like text messages or social media. The fake messages will trick the victim into downloading malware through an attachment or visiting a malicious site masquerading as a legitimate site where they enter sensitive data.
Typical phishing attacks use a blanket message sent to a large number of people, hoping to trick someone into the desired action. But, other forms of phishing attacks take a much more targeted approach.
- Spear phishing researches potential victims to produce more convincing fake messages.
- Whale phishing is a form of spear phishing that focuses on high-value targets such as business executives.
#4: Denial of Service (DoS)
A Denial of Service (DoS) attack, also called a brute-force attack, floods a website or server with huge amounts of traffic to take it offline.
By overwhelming systems, DoS attacks prevent legitimate users from accessing services.
An extension of DoS is DDoS, utilizing many compromised devices to increase the traffic it is possible to send. This is often performed through a botnet, a large number of malware-infected devices the attacker controls. Cybercriminals may have various reasons for launching DoS attacks, including:
- Demanding a ransom to stop the attack.
- Political activism targeting government agencies or corporations.
- An unethical form of competition between businesses in the same industry.
- Cyber warfare sponsored by states to weaken their adversaries.
- Causing chaos and disrupting services.
#5: Man-in-the-Middle (MITM)
A Man-in-the-Middle (MITM) attack is when the threat actor positions themselves between two parties (e.g., two people, a person and a server, etc.) to eavesdrop and intercept communications. The attacker can then steal sensitive data, such as login credentials.
MITM attacks often take advantage of unsecured public WiFi networks, where it is easy to intercept user data.
#6: Injection
Injection attacks exploit software vulnerabilities to input malicious code into a system. This is often injected into the system through public-facing inputs like:
- Search bars
- Login fields
- API requests
Injection attacks enable the attacker to execute unauthorized commands, access data without authorization, or take over system capabilities. Common forms of injection attacks include Structured Query Language (SQL) injection and Cross-Site Scripting (XSS).
During SQL injection, an attacker inserts malicious code that enables them to reveal information from an SQL database. XSS injects malicious code into a legitimate web page so that it runs on subsequent visitors’ browsers.
#7: Zero Day Exploits
Many cyber attacks exploit vulnerabilities in software, inherent weaknesses in the code that allow threat actors to manipulate applications for their own gain.
Often, these are known vulnerabilities that have not been properly patched or protected against.
But, new vulnerabilities are also being discovered, known as zero day exploits. These have the potential to cause major cyber attacks as they offer a new way of compromising business networks before they can implement a cybersecurity response.
There is a window of time before security teams find a way to fix the issue, and organizations update their software to patch the vulnerability.
#8: Supply Chain Attacks
Modern applications utilize pre-existing code, either proprietary or open source.
This is known as the software supply chain. Hackers can infiltrate systems by exploiting vulnerabilities in the software supply chain. This includes targeting unmaintained libraries or component code that is no longer updated for the latest vulnerabilities.
#9: Cryptojacking
A form of malware that takes control of a victim’s computer resources to mine cryptocurrency.
The attacker remains hidden while hijacking system resources for their own financial gain. Cryptojacking can also infiltrate the user’s browser by running code in JavaScript.
Feedback