5 ways hackers use digital channels to launch VIP attacks

VIP attacks target high-profile individuals like company executives, politicians, and celebrities. For enterprise businesses, executives present a critical target for hackers, usually because they have access to a vast wealth of information. Politicians are commonly targeted by hacktivists and state operators for socio-political reasons. Celebrities, by contrast, are targeted for a multitude of reasons and frequently find themselves subjected to gross invasions of their private lives.

All these VIP attacks have a few things in common. Aside from the obvious fact that they can lead to catastrophic reputational, personal or financial damage, they often take place through vulnerable digital channels. The social networks and mobile technologies we use everyday are part of a constantly expanding attack surface that high-profile targets need to be aware of. Here are five ways hackers target VIPs:

1. Botnet Attacks

A botnet refers to any number of internet-connected devices running one or more bots. These are most often used to launch denial of service attacks, but are increasingly being weaponized by hacktivists and state operators to sway public opinion. Although these attacks don’t target VIPs directly, they can greatly increase the spread of misinformation and have a profound influence on entire populations. Many attacks attempt to undermine reputations of senior political figures and parties to the extent they can erode the very foundations of democracy.

2. Doxxing Campaigns

Doxxing is the revelation and online posting of personal details, such as phone numbers, home address, or even family members’ names. While doxxing can have legitimate uses in law enforcement, it’s most often used in online shaming, harassment, extortion, or coercion. Celebrities are common targets, though politicians, journalists, and other influential figures may also be targeted during hacktivist campaigns. Doxxing often uses information that’s already available on the internet, although some attacks may use social engineering techniques to extract personal information.

3. Account Takeovers

Account takeover (ATO) are a cyber attack that involves a hacker gaining access to an online account belonging to someone else and then using it for themselves. Hackers may use a stolen social media account, for example, to cause reputational damage while impersonating the legitimate owner of the account. Other common cases include compromised accounts on e-commerce stores and online banks. Hackers often obtain the necessary login credentials by carrying out phishing scams. ATOs are a rapidly growing concern already costing $5.1 billion in the U.S. alone.

4. Account Impersonations

Account impersonation is a major problem on social media where cybercriminals set up fake accounts to impersonate brands and individuals. Malicious accounts may be used to lure people into divulging sensitive information, cause reputational damage, or harass other users. When targeting company executives, hackers typically attempt to dupe other employees into surrendering confidential data, downloading malware, or clicking on malicious links. Although many social networks now require new users to verify their identities, impersonation through account takeovers remains a common technique for conducting phishing scams on social media.

5. Spear-phishing Attacks

Often the most dangerous attacks of all, spear-phishing targets specific victims, rather than being carried out en-masse. After forming an intimate profile of their target victim, attackers will attempt to build trust before trying to obtain sensitive information from them. Given the fact they have access to highly valuable data, corporate executives are some of the most common targets of these scams. However, other spear-phishing attacks instead target the most vulnerable persons (MVPs) in the organization, which tend to be those who are further down the corporate ladder but still have access to valuable data, such as HR or IT managers.