Hacktivist and Cryptocurrency Theft Attacks... AhnLab's Forecast of 5 Major Cybersecurity Threats

AhnLab announced on the 28th its "Top 5 Cybersecurity Threats Outlook" containing forecasts of major cybersecurity threats that may occur in 2024.

The five major security threats are ▲increased cyberattacks and hacktivist activities among hostile forces ▲accelerated changes in Ransomware-as-a-Service (RaaS) organizations ▲rampant ransomware targeting virtualization platforms ▲spread of Android malicious apps targeting financial and personal information ▲intensified attacks targeting personal wallets for cryptocurrency theft.

AhnLab expects cyberattacks between hostile forces to increase next year. Deepfake technology may be used to produce fake news for propaganda and agitation purposes or falsely claim that previously leaked information is a new hacking result. State-backed attack groups may attempt not only activities to steal information from hostile forces but also attacks targeting infrastructure disruptions such as power outages. To this end, attackers are expected to attempt "supply chain attacks," targeting relatively less secure partners and suppliers in addition to directly attacking the target. Hacktivist activities are also expected to increase. Hacktivists are a combination of hacker and activist, referring to activists who use hacking as a means of struggle on the internet. They are expected to easily produce and widely distribute deepfake voices and videos using artificial intelligence (AI) to achieve political or ideological goals.

Second, RaaS is a new ransomware business model where cybercriminals provide the tools and services necessary for ransomware distribution and management. These groups may accelerate "rebranding," moving through forums and marketplaces on the dark web while changing their names. They are also likely to adopt a so-called "multi-ransomware" strategy, using variants of ransomware employed by other RaaS organizations to make it difficult for investigative agencies to track them and to have alternative means in case of attack failure.

Third, ransomware attacks targeting virtualization platform servers are expected to increase. Solutions with high market share are particularly likely to be targeted. For example, ransomware targeting VMware’s hypervisor platform ESXi servers has been increasing in number and variants since it first appeared in 2020.

Fourth, malicious apps targeting users’ money and sensitive information are expected to become more sophisticated. Malicious apps can spread across various platforms including smartphones, smart TVs, smartwatches, and smart homes. Recently, fraudulent loan apps have been collecting and leaking personal information such as contacts and income certificates, as well as financial information like bank account details. These types of apps are becoming increasingly sophisticated, creating elaborate mobile websites to avoid suspicion and even appearing on the official Google Play store.

Lastly, attacks targeting cryptocurrency are expected to intensify. Various attack groups continuously target users’ personal wallets and blockchain vulnerabilities to steal cryptocurrencies, which are difficult to trace transaction histories. With the cryptocurrency halving event approaching around April 2024, which reduces the supply of cryptocurrency, the overall price of cryptocurrency assets is expected to rise. Attackers are expected to focus more on individual users, who may have relatively weaker security, rather than hacking cryptocurrency exchanges equipped with security systems, to increase their success rate.

To prevent such security threats, organizations should prepare optimized countermeasures such as ▲frequent security inspections and patch applications for PCs, operating systems, software (SW), and websites within the organization ▲utilization of security solutions and services and conducting internal employee security training ▲monitoring authentication logs for administrator accounts ▲introducing Multi-Factor Authentication (MFA) tailored to the organization’s environment.

Individuals should follow security guidelines such as ▲refraining from opening attachments or URLs in emails from unknown sources ▲downloading content and software only from official channels ▲applying the latest security patches for software, operating systems, and internet browsers ▲using two-factor authentication in addition to passwords when logging in ▲keeping antivirus software up to date and running real-time monitoring functions.

This content was produced with the assistance of AI translation services.