COMMENTARY: AI’s rapid transformation of cybercrime hasn’t necessarily meant more or new varieties of attack. But it’s supercharged existing attack techniques, letting bad actors pull off attacks faster and easier than ever before – as well as hit a wider range of targets.
AI has democratized cybercrime by putting sophisticated tools in the hands of pretty much anyone who wants them. From AI-assisted phishing kits to more convincing impersonation and deepfake attacks, threat actors don’t have to be skilled hackers to commit crime and fraud.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
This lowered barrier to entry has changed how defenders need to approach their strategy, putting new factors into focus as attack volumes surge.
While AI won’t necessarily create novel techniques, it will increase the speed and scale of how attackers can conduct these attacks. Attackers will use many of the legacy techniques, but they’ll use them at a larger scale – for instance, Infostealer variants that are built solely on AI. Attacks like this are likely to become more frequent.
With the level that AI has reached today, we’ll likely see many more (and more realistic) deepfake attacks – and even exploits like setting up fraudulent Microsoft Teams meetings where the victim thinks they are talking to someone they know, but it’s actually AI.
Insider threats will also become much more believable in the near future. Security teams may start to see more identity fraud-type attacks, especially with how easy it’s become to make a real-looking passport and other “official” documents.
Attackers now employ multiple tactics that make their jobs easier all around. There are some tools that can essentially duplicate any streaming service’s page and make it look exactly the same as the real one. There's no level of skill needed for this: it’s now possible to just create an account and instruct the tool to create the page.
There are legitimate platforms today that empower businesses and individuals to create professional-looking websites in just a few minutes, including HTTPS certificates. This makes it easy for attackers to spin up fake sites for illicit purposes. Researchers have found that criminals use these tools to create fake sites for cryptocurrency-related scams, including airdrop and “connect wallet” pages.
For instance, our team has observed bad actors using the infrastructure and HTTPS certificates of legitimate tools to feign authenticity while impersonating well-known sites like Booking.com. Campaigns like this reveal that attackers can converge lookalike domains, search optimization tactics and visual mimicry to create fraudulent infrastructure at scale. Even if these pages do not have forms to harvest credentials, they can act as staging layers for a larger traffic-manipulation or phishing strategy.
What’s a defender to do? How to prioritize among a sea of challenges?
There are three steps that IT teams must take to protect organizations against these threats. Teams must prioritize attacks by scale and exploitability, not novelty. For defenders, it’s important to look at:
- Which attacks can now be launched against thousands or millions of targets simultaneously?
- Which existing attack techniques have become accessible to less-skilled criminals because of AI?
- Which threats are most likely to overwhelm the company’s defenses through sheer volume?
Focus on protecting people and identities, not just infrastructure. Attackers continue to succeed because they exploit people. AI makes social engineering substantially more convincing. But rather than assuming users will catch every scam, defenders should prioritize controls that reduce the consequences of inevitable human mistakes.
Prioritize intelligence that explains who targeted the company before they attack. Organizations often overlook one of their best defensive advantages: external threat intelligence. As AI increases attack volume, organizations won't have the ability to investigate every alert. Instead, they need better context.
Stop the ‘unstoppable’ threats
Artificial intelligence has transformed cybercrime, but not in the way many expect. Rather than inventing novel attack techniques, AI increases the speed, scale and accessibility of existing ones. From AI-assisted phishing kits to more convincing impersonation and deepfake attacks, AI lowers the barrier to entry for cybercriminals. That’s bad news for IT security teams.
So, what should defenders pay attention to as attack volumes surge without a corresponding rise in sophistication?
They need to prioritize attack types by how exploitable they are and how much damage they can do, rather than just focus on the newest threats. They also need to mitigate the exploitability of the people and identities within their organization, as well as leverage threat intelligence for a more holistic view. These steps will help security teams defend what’s most precious from what’s most dangerous.
Ivan Khamenka, cyber threat intelligence analyst, Netcraft
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
