Projections for 2024’s Advanced Threats Landscape

Issue 7 2023 News & Events, Information Security

Kaspersky Global Research and Analysis Team (GReAT) experts offer insights and projections for 2024 in the Kaspersky Security Bulletin, with a focus on the evolution of Advanced Persistent Threats (APT).

Kaspersky researchers predict APT actors will introduce new exploits on mobile, wearables, and smart devices and use them to form botnets, refine supply chain attack methods, and use AI for more effective spear-phishing. These advancements are anticipated to intensify politically motivated attacks and cybercrime.

Emerging AI tools will streamline spear-phishing message production, even enabling the mimicry of specific individuals. Attackers may devise creative automation methods by gathering online data and feeding it to LLMs to craft letters in the style of a person connected to the victim.

‘Operation Triangulation’ marks a ground-breaking year for mobile exploits, potentially inspiring more research into APTs attacking mobile, wearables, and smart devices. We will likely witness threat actors broadening their surveillance efforts, targeting various consumer devices through vulnerabilities and ‘silent’ exploit delivery methods, including zero-click attacks through messengers, one-click attacks via SMS or messaging apps, and network traffic interception. Protection of personal and corporate devices has become increasingly vital.

The exploitation of vulnerabilities in commonly used software and appliances is yet another point where we should be vigilant. The discovery of high and critical severity vulnerabilities sometimes receives limited research and delayed fixes, potentially paving the way for new, large-scale, and stealthy botnets capable of targeted attacks.

State-sponsored actors and hacktivism a new normal

State sponsored cyberattack numbers also have the potential to surge in the year ahead, amid increasing geopolitical tensions. These attacks will likely threaten data theft or encryption, IT infrastructure destruction, long-term espionage, and cyber sabotage.

Another notable trend is hacktivism, which has become more common as part of geopolitical conflicts. Geopolitical tensions indicate a likely increase in hacktivist activity, both destructive and aimed at spreading false information, leading to unnecessary investigations and subsequent alert fatigue of SOC analysts and cybersecurity researchers.

Other advanced threat predictions for 2024 include:

Supply-chain-attacks-as-a-service: Supply chain attacks targeting smaller firms to breach major ones; the Okta breaches in 2022-2023 highlight the threat’s scale. Motives of such attacks may range from financial gain to espionage; 2024 might witness new developments in dark web access market activities related to supply chains, enabling more efficient and large-scale attacks.

Emergence of more groups offering hack-for-hire services: Hack-for-hire groups are on the rise, providing data theft services to clients ranging from private investigators to business rivals. This trend is expected to grow in the coming year.

Kernel rootkits are hot again: Despite modern security measures like Kernel Mode Code Signing, PatchGuard, HVCI (Hypervisor-Protected Code Integrity), kernel-level code execution barriers are being bypassed by APTs and cybercrime groups. Windows kernel attacks are on the rise, enabled by WHCP abuses, and the underground market for EV certificates and stolen code signing certificates is growing. Threat actors are increasingly leveraging BYOVD (Bring Your Own Vulnerable Driver) in their tactics.

Managed File Transfer systems used for advanced attacks: Managed File Transfer (MFT) systems face escalating cyber threats, exemplified by 2023 breaches of MOVEit and GoAnywhere. This trend is poised to escalate, with cyber adversaries eyeing financial gains and operational disruptions. The intricate MFT architecture, integrated into broader networks, harbours security weaknesses. Organisations should implement robust cybersecurity measures, including Data Loss Prevention and encryption, and foster cybersecurity awareness to fortify MFT systems against evolving threats.

“In 2023, the notable surge in the availability of AI tools did not elude the attention of advanced malicious actors engaged in extensive and highly sophisticated campaigns. However, we anticipate that upcoming trends go beyond AI implications, including new methods for conducting supply chain attacks, the emergence of hack-for-hire services, novel exploits for consumer devices, and more. Our goal is to provide defenders with advanced threat intelligence that stays ahead of the latest threat developments, enhancing their capacity to fend off cyberattacks more effectively,” says Igor Kuznetsov, Director, Global Research and Analysis Team (GReAT) at Kaspersky.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Pentagon appointed as Milestone distributor
Elvey Security Technologies News & Events Surveillance
Milestone Systems appointed Pentagon Distribution (an Elvey Group company within the Hudaco Group of Companies) as a distributor. XProtect’s open architecture means no lock-in and the ability to customise the connected video solution that will accomplish the job.

From the editor's desk: Securing your secure access
Technews Publishing News & Events
      Welcome to SMART Security Solutions’ first print publication of the year, the SMART Access & Identity Handbook 2024. In this issue, we cover various issues relevant to this industry, from digital to ...

Access & identity expectations for 2024
Technews Publishing IDEMIA ZKTeco Gallagher Salto Systems Africa Regal Distributors SA Reditron Editor's Choice Access Control & Identity Management Information Security AI & Data Analytics
What does 2024 have in store for the access and identity industry? SMART Security Solutions asked several industry players for their brief thoughts on what they expect this year.

International access manufacturer sets up shop in SA
Technews Publishing Access Control & Identity Management News & Events Products & Solutions
The South African security market can always use some good news, and this year, STid has obliged by formally entering the South African market, setting up its main office in the Boomgate Experience Centre in Roodepoort, Johannesburg.

Zero Trust and user fatigue
Access Control & Identity Management Information Security
Paul Meyer, Security Solutions Executive, iOCO OpenText, says implementing Zero Trust and enforcing it can create user fatigue, which only leads to carelessness and a couldn’t care attitude.

Passwordless, unphishable web browsers
Access Control & Identity Management Information Security
Passkey technology is proving to be an easily deployed way to bring unphishable, biometric-based security to browsers; making identification and authentication much more secure and reliable for all parties.

Re-introduction of the booking system
PSiRA (Private Security Ind. Regulatory Authority) News & Events
[Sponsored] PSiRA is reintroducing the booking system for branch visits. Effective Monday, 4 December 2023, clients will be required to book a slot to visit any PSiRA branch.

From the editor's desk: A sad but exciting goodbye
Technews Publishing News & Events
Welcome to the final monthly issue of SMART Security Solutions. This is the last issue of the year and the last monthly issue we will print. The SMART Security Solutions team wishes all our readers and advertisers a relaxing festive season and a peaceful and prosperous 2024.

Regal celebrates successful golf day
Regal Distributors SA News & Events
Regal Distributors held its first official Regal Golf Day on 18 October at the Glendower Golf Course in Johannesburg. SMART Security Solutions was there on a hot summer’s day to meet many players and sponsors around the course.

Gallagher Security releases Command Centre v9
Gallagher News & Events Access Control & Identity Management Integrated Solutions
Richer features, greater integrations, with the release of Gallagher Security’s Command Centre v9 security site management software designed to integrate seamlessly with various systems and hardware.