Social engineering remains a primary initial access vector for cybercriminals, according to a new report from Europol.
“Social engineering, which exploits human error to gain access to systems or personal information, stands out as a prominent technique used by criminal actors in this context,” Europol says.
“Initial Access Brokers (IABs) have been increasingly focused on using such techniques for the acquisition of valid account credentials as an entry point to the victims’ systems.
"This initial access can then be leveraged in a multitude of ways by criminal actors. For example, access credentials for remote services are widely used by ransomware groups and their affiliates to compromise corporate networks, which can lead to data theft (exfiltration) and the deployment of ransomware.”
The report also warns of a surge in infostealer malware, allowing criminals to gather information that can be used in future attacks.
“Phishing techniques are the main vector for the distribution of infostealers,” Europol says. “Criminals use a variety of methods to achieve this, including sending emails, text messages, or messages on social media that contain malicious attachments or URLs which introduce malware into the victim’s system. Malicious websites are also propagated through search engine advertising tools and search engine optimisation (SEO) poisoning. In the latter case, criminals manipulate web search results to lead users to websites containing malware.”
Europol also notes that AI tools have increased the effectiveness of social engineering attacks, enabling threat actors to easily generate convincing lures.
“The efficacy of many of the aforementioned social engineering techniques has been improved by the wider adoption of LLMs and other forms of generative artificial intelligence (genAI),” the researchers write. “Phishing texts and scripts, generated to incorporate the language and cultural nuances of the victims’ location, can improve the efficacy of campaigns. Recent research on the topic indicates that phishing messages generated by LLMs have a significantly higher click-through rate than those likely written by humans.”
New-school security awareness training can give your organization an essential layer of defense against social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Europol has the story
Here's how it works:
