Cybersecurity Ventures’ report, “2023 Official Cybercrime Report,” states that the cost of cybercrime and damage costs are expected to reach USD 9.5 trillion and USD 10.5 trillion respectively in 2024. With no signs of hackers slowing down, it is important to stay informed about emerging threats to prevent data breaches.
In recent years, firms have seen many sophisticated cybersecurity threats like phishing, vishing, and ransomware. The above staggering figures reflect the need to stay vigilant in the face of potential cyberattacks that may arise at all levels in the future.
Cybercrime threats to focus on in 2024
More Open Source Vulnerabilities in Code Bases
The open source code base is prone to known and unknown security gaps that firms fail to identify, leaving them vulnerable to attacks. These risks become more significant because many firms still use legacy or outdated versions of open-source operating systems.
Hackers exploit the code vulnerabilities to steal confidential data by executing zero-day exploits.
As per a recent report by Synopsys, “Open Source Security and Risk Analysis Report 2023,”
To avoid such vulnerability exploits, firms must
- Keep updating the codes and use software that can help prevent such threats.
- Create an inventory of all third party scripts and libraries used on a website.
- Monitor third party components for known vulnerabilities, including open source vulnerabilities.
- Use vulnerability databases to seek information about vulnerabilities.
- Deploy automated tools for better visibility into software components, associated vulnerabilities, and their impact on infrastructure.
- Prioritize vulnerabilities based on factors like exploitability, potential impact, and software usage for more effective vulnerability management.
Phishing Continues to be Preferred Method for Hackers in 2024
Spreading malware is one of the easiest techniques for attackers to exfiltrate valuable data. This is why Phishing is still one of the choices for hackers and will continue to be in 2024.
Tech advancements have made hackers smarter, enabling them to phish organizational data via mobile phishing, including vishing (voice phishing), smishing (SMS phishing), and quishing (QR phishing).
Listen to our podcast on “Data Protection Day: The evolution of Phishing and the latest on Vishing & Quishing”
Data Protection Day: The evolution of Phishing and the latest on Vishing & Quishing
For example- Agent Tesla is one of the leading malware threats that can steal sensitive information.
Since Microsoft began blocking macros in 2022, threat actors have experimented with many phishing tactics, techniques, and procedures (TTPs). These include legacy file types such as virtual hard disk (VHD), compiled HTML (CHM), and OneNote (.one).
As per a recent report by Perception Point, “The 2024 State of Phishing Report,”
- From just August 2023 to September 2023 alone, there was a steep 427% increase in the use of malicious QR codes.
As per a report by Securonix,” 2023 Securonix Threat Report,”
- Phishing attacks increased 62% over the last year, recently leveraging corporate tools like Microsoft OneNote, and continue to be the leading vector for threats.
- The average number of TTPs and IoCs identified per month increased by 14% compared to the previous period.
- Phishing attacks increased 62% over the last year, recently leveraging corporate tools like Microsoft OneNote, and continue to be the leading vector for threats.
The above statistics indicate that the Phishing attacks’ damage on businesses will continue to be colossal. Phishing is and will be an alarming cybersecurity attack that firms need to focus on. To prevent it, firms must-
- Encourage the use of unique passwords for all accounts
- Implement two-factor authentication on all accounts
- Encourage the teams to refrain from providing personal information in response to an unsolicited request.
- Secure email gateways to block deceptive emails.
- Include security awareness in the organization’s culture.
Business Email Compromise (BEC) Threats
BEC threats involve using email to trick someone into sending money or divulging confidential company data. These emails seem legitimate as they contain common phrases, resulting in a high clickable link rate.
As per a recent report by Ironscales, “Defending the Enterprise: The Latest Trends and Tactics in BEC Attacks,”
- Large organizations anticipate a 43.3% increase in the threat created by BEC attacks in the next 12 months.
- One in five organizations has experienced these types of BEC attacks in the past 12 months.
- The technology with the most to offer for detecting and remediating BEC attacks is AI-powered anti-phishing tools, although only 55% of organizations currently use such tools.
- 28% of respondents already say that fraudulent connection requests on social media are used frequently during the setup for a BEC attack
- The use of fraudulent phone calls is not far behind (22%)
BEC threats are no longer restricted to traditional email patterns as hackers continuously find new ways to execute email threats. Hackers use tools beyond emails, including-
- mobile messaging and chats
- cloud-based applications such as LinkedIn, WhatsApp, Twitter, and Microsoft Teams.
Therefore, firms need to have stringent defensive measures to mitigate the threats. In 2024, they must continue to build a corporate risk management strategy and vulnerability framework.
- Firms must encourage employees to-
- Avoid using free web-based email accounts.
- Enable multi-factor authentication for business email accounts
- Refrain from opening any email from unknown parties
- Always verify before sending money or data
- Double-check the sender’s email address.
- Secure the domain.
Conclusion
The cyber security landscape is expected to become even more challenging and complex in 2024. Predicted threats indicate a rise in phishing attacks, BEC attacks, and open-source vulnerabilities.
To combat these threats, firms must adopt a multi-layered approach that combines tech solutions, employee awareness and training, and proactive risk management strategies.
By staying informed, embracing innovative tech, and fostering collaboration, firms can mitigate risks, strengthen their defenses, and safeguard the digital future.
Check Out The New ITsecuritywire Podcast. For more such updates follow us on Google News ITsecuritywire News.
