Industry executives and experts share their predictions for 2024. Read them in this 16th annual VMblog.com series exclusive.
Hactivism, victim selection, and more
By Rik Ferguson, VP of Security Intelligence at Forescout
Each year, threat actors and security solution providers alike generate new strategies to dominate the cyber landscape – 2023 was no different.
This year, the industry evolved even further with the rapid expansion and adoption of AI technologies, significantly advancing organizations’ ability to automate operations, make their processes more efficient and analyze networks to identify any unusual activity. However, on the “dark side of cyber,” criminals are getting smarter – and we’ll see them become more deliberate in how they target their victims.
Here are some of the most significant threat actor techniques that I expect to be on the rise in 2024.
Threat actors will opt for “denial of confidentiality” through leak sites as they steadily move away from “denial of access” through encryption.
Ransomware is dying. The fact of the matter is that running traditional ransomware operations is a time-consuming and pointless overhead- especially when data theft and extortion work just as well, or better. There is no key management overhead to worry about, no coding of cryptographic modules, no good guys breaking the encryption, no pesky recovery from backup. Just ‘data out and cash out’. We’ll see that, ironically, the best defense against the new model of “ransomware” is encryption itself. Data must be rendered ‘unleakable’ in order to prove an unprofitable endeavor for bad actors.
Threat actors will increasingly target misconfigured devices/services.
The volume and availability of non-standard, unmanaged devices exposed to the internet, and configured by non-security-minded users, is growing exponentially. Poor configuration and insecurity-by-design make them prolific and highly available beachheads into homes and organizations. Insecurity-by-design means it is often simple to escalate privileges through vulnerabilities and move laterally. These devices are often not as well secured or as visible as the traditional IT estate and remain uniquely vulnerable.
Ransomware affiliates will take a more tailored approach to victim selection.
Bad actors will be more strategic in their victim selection, which will include tactics such as retargeting organizations that have been known to pay ransoms before and selecting only victims that have cyber incident insurance. Along these lines, we’ll see an emerging market for victim-profiling data, perhaps as-a-service, similar to the “suckers list” for romance and 419 scams.
Hacktivists will expand their scope of targets for critical infrastructure and other Internet of Things (IoT ) devices.
In 2024, we will see hacktivist target groups not only include devices deployed in targeted countries, but also devices manufactured in those countries and deployed elsewhere. This will significantly raise the threat level globally, and organizations who feel they may be at risk should conduct a thorough audit and risk assessment so that they can take the appropriate steps to secure their infrastructure – regardless of where it has been manufactured.
##
ABOUT THE AUTHOR
Rik Ferguson, Vice President of Security Intelligence at Forescout, is one of the leading experts in cybersecurity. He is also a Special Advisor to Europol’s European Cyber Crime Centre (EC3) and an advisor to the European Union. In April 2011 Rik was inducted into the Infosecurity Hall of Fame. With twenty-five years’ experience in information security, Rik is actively engaged in research into online threats and the underground economy. He also researches the wider implications of new developments in the Information Technology arena and their impact on security, both in the enterprise and for society as a whole, publishing papers, articles, videos and participating in thought-leadership initiatives.
