Despite the discussions surrounding new technologies like ChatGPT and more sophisticated cyber attacks, many cybercriminals still rely on simple yet effective methods. These methods target unsuspecting individuals and exploit human behavior, such as basic phishing attacks and credential harvesting.

According to a recent report by the Cybersecurity and Infrastructure Security Agency (CISA):

  • Most successful intrusions into critical infrastructure networks and state and local agencies occur through the use of valid account credentials.
  • Almost 90% of infiltrations last year involved a combination of valid credential compromise and spear-phishing attacks.
  • Valid accounts were responsible for 54% of all attacks analyzed in the agency’s annual risk and vulnerability assessment.

Many threat actors obtain these credentials through social engineering, which remains effective due to human error. From the perspective of malicious actors, there is little incentive to create new and complex threat methods when the old ones still work well.

Automation Gives an Advantage to Cybercriminals

In recent years, cybercriminals have increasingly weaponized AI and automation. Automation has enabled them to carry out more attacks quickly and easily. Money launderers, for example, automate recruitment campaigns to find their accomplices.

Older attacks continue to be effective, as they do not rely on viruses or Trojans but solely on user credentials and social engineering. These attacks are easily automated.

Automation also enables attackers to carry out credential stuffing, a prevalent cyberattack that involves using stolen usernames and passwords to gain access to accounts. This technique works because many individuals use the same login credentials across multiple systems. Although the success rate of this attack is relatively low, it remains popular.

Moreover, cybercriminals are increasingly utilizing AI to perform various malicious actions, including tricking network activity algorithms and creating deepfakes to imitate human behavior. The impact of generative AI on their ability to generate malicious code quickly is also significant.

Defending Against Basic Attacks

As social engineering continues to be effective, organizations need to strengthen their defenses by enhancing human awareness. This involves providing regular cybersecurity training to keep employees informed about the latest threats, tactics, and best practices.

Comprehensive cybersecurity awareness training helps employees recognize hazards, protect their organizations, and safeguard their personal digital lives. This training is especially crucial in the era of remote work.

It is important for employees to create unique usernames and passwords for each application as a fundamental security measure. Organizations should consider incorporating phishing simulation services to educate employees on recognizing phishing attempts and reinforcing corporate processes.

Additionally, employees should adopt the following practices:

  • Check for typos and grammar mistakes in emails: Phishing emails often contain obvious errors. Valid domain names should also be verified in the sender’s email address.
  • Remain skeptical and cautious: Be wary of suspicious phone calls or emails.
  • Use a VPN on public Wi-Fi: A VPN prevents criminals from disseminating ransomware through unprotected connections.
  • Avoid sharing sensitive information: Never disclose Social Security numbers or credit card details via email or phone.

Responding Effectively to Basic Attacks

While the focus often lies on advanced cyber techniques, simpler attacks thrive due to their effectiveness. Social engineering, phishing, and credential harvesting still exploit human vulnerabilities. To counter these pedestrian threats, organizations must prioritize ongoing cybersecurity awareness training. Employees need to stay updated on the latest threats, know how to identify, counter, and report them. Protecting both professional and personal digital lives is crucial, especially with the rise of remote work. Although some attackers may devise sophisticated attacks, basic training will help defend against automation- and AI-assisted attack methods.