As cybercrime continues to evolve and grow more sophisticated, Europol stated on Monday that human oversight still remains the weakest link in cybersecurity.
According to authorities, criminals continue to rely on phishing and social engineering to spread malware and gain initial access to their victim’s networks.
The EU’s law enforcement agency made the statement in its Internet Organised Crime Assessment 2023. The report contains Europol’s assessment of the current cybercrime landscape and its changes over the last two years.
Most Common Intrusion Tactics: Phishing Emails Containing Malware
A key finding in the report is that cybercrime groups continue to adapt their operations to stay ahead of measures taken by law enforcement. Phishing and social engineering remain the most heavily relied on attack vectors. Specifically, cybercriminals use phishing emails that contain malware, Remote Desktop Protocol (RDP) brute forcing, and VPN vulnerability exploitation to gain initial access to systems.
Malicious actors exploit vulnerabilities in legitimate tools that are built into operating systems. This allows them to gain a foothold within, and move across, the victim’s network. Furthermore, Europol states that phishing kits are more widely available and do not require extensive technical expertise to deploy. This is a huge factor that has opened the door for more criminal networks to deploy phishing attacks, authorities said.
Another worrying recent trend is the emergence of malicious generative AI tools like WormGPT — programs that allow actors to write up convincing phishing and BEC emails that can bypass security checks. Poor grammar and spelling have long been a red flag when trying to spot such scam communications, a warning sign that malicious AI can now work around.
Phishing attacks allow criminals to steal data and login credentials, valuable assets in the cybercrime community. Europol highlighted the phenomenon of groups selling data to multiple buyers. As a result, a data breach victim is the subject of numerous cybercrimes.
“Victim information is often monetised to its full extent — meaning that it can be sold to several buyers — which leads to targets being re-victimised by fraudsters and malware distributers alike,” the report states.
Organized Cybercrime Highly Sophisticated, Run a Co-Dependant Operation
Apart from pointing out the continuing threat of impersonation-style attacks, the report contains insights into how organized cybercrime functions on the surface and dark web. Europol stated that organized cybercrime is a very sophisticated network that goes beyond individual actors deploying malicious files on their victims.
Several operators function similarly to well-run businesses and constantly feed their network of cybercriminals with services to continue their nefarious activities.
“Cybercrime services are widely available and have a well-established online presence, with a high level of specialisation inside criminal networks and collaboration between illicit providers,” Europol states.
“The illicit service providers cater to a large number of criminal actors by offering monitoring, delivery and obfuscation services. Such services are often offered for sale or advertised on dark web forums and marketplaces.”
Criminals Rely on Impersonation for Child Sexual Exploitation and Fraud
The report also has insights into the problem of online child sexual exploitation and online fraud. Criminals often impersonate other people on social media to carry out these acts.
“Child sexual exploitation offenders make extensive use of social media to engage with their victims, interacting with them often behind a false identity,” the report states.
“Online fraudsters impersonate legitimate businesses, institutions, non-governmental organisations and individuals to solicit money
transfers or obtain access to the victims’ sensitive information,” Europol added.
Furthermore, they leverage their wider network of malicious actors to repeatedly victimize children.
“Victims of child sexual exploitation suffer revictimisation both offline and online. Hands-on abusers often perpetrate their offences for a significant amount of time and, in several cases, encourage other offenders to abuse the victim as well.”
Navigating parenting and exposure to the internet can be very challenging for parents. We spoke to Dr. Justine Pardoen from the Bureau Jeugd and Media, as well as Jayne Hitchcock, President of Working to Halt Online Abuse, for expert advice on internet safety for kids and teens.
Additionally, parents or caretakers can check out the following resources:
- Our Parent’s Guide to Stop and Prevent Cyberbullying
- Social Media For Kids: How to Keep it Safe and Fun
