Targeted Social Engineering on the Rise With Lowering Phishing-as-a-Service Costs

Targeted individuals were the most common victims of social engineering attacks in the second half of 2022 and the first half of 2023, according to researchers at AtlasVPN.

“During the observed period, around 31% of all social engineering attacks were aimed at targeted individuals, with the public administration sector following second at 18% of incidents,” the researchers write.

AtlasVPN continues, “The ‘all’ category encompasses cybersecurity events that have a global effect across markets [and] was the third-most (7.97%) targeted sector in social engineering attacks. It reinforces the notion that cyber threats transcend the boundaries of specific industries or sectors.

The banking and finance sector (5.49%) follows closely, while the postal and courier sector (5.22%) rounds out the top five social engineering victims. The difference in share percentages between first place and others is a testament to how threat actors view targeting individuals as the most profitable attack vector.”

The researchers observed the following five trends in social engineering attacks in 2023:

1. “Phishing and Phishing-as-a-Service (PhaaS): Phishing remains a prevalent and influential tactic due to its time efficiency, with the emergence of PhaaS amplifying its reach."
2. “Availability and Affordability of Services: The availability and affordability — with prices reported as low as 15 USD — of PhaaS and similar services contribute to the proliferation of social engineering attacks."
3. “AI-Driven Innovations: The use of AI for crafting convincing phishing emails, deepfakes, and AI-driven data mining, is driving innovation in social engineering tactics."
4. “Changes in Threat Actor Behavior: Threat actors are adapting to overcome increased security measures, including multi-factor authentication, employing novel approaches like MFA fatigue attacks, adversary in the middle (AitM), and SIM swapping."
5. “Personal and Intimidating Approaches: Threat actors are using more personal and intimidating approaches, targeting individuals with personal threats and even involving their family members, marking a progression in the scope of social engineering attacks.”

KnowBe4 enables your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

AtlasVPN has the story.