The Rise of the Rookie Hacker – A New Trend to Reckon With

Dec 21, 2022The Hacker NewsThreat Detection and Response

More zero knowledge attacks, more leaked credentials, more Gen-Z
cyber crimes – 2022 trends and 2023 predictions.

Cybercrime remains a major threat to individuals, businesses,
and governments around the world. Cybercriminals continue to take
advantage of the prevalence of digital devices and the internet to
perpetrate their crimes. As the internet of things continues to
develop, cybercriminals will have access to a greater number of
vulnerable devices, allowing them to carry out more sophisticated
attacks. Cybercrime is expected to become increasingly profitable
as criminals continue to find new and better ways to monetize their
attack as entry barriers to cybercrime keep going down.

This article discusses key trends we’ve noticed in 2022 that
will likely continue in 2023, which we’ll also elaborate on in the
upcoming webinar “The Rise of the Rookie Hacker – a new trend
to reckon with^[1]” on January 11th.

Leaked credentials will continue to be the main attack
vector for initial access

According to IBM’s cost of a breach 2022 report, use of stolen
or compromised credentials remains the most common cause of a data
breach.

The main source for leaked credentials in 2022 was Info-Stealers
– a malware that can steal stored credentials from browsers,
cookies (used for session hijacking and to bypass MFA), crypto
wallets, and more. Redline Stealer, in particular, gained a lot of
popularity among threat actors which led to the creation of several
other stealers such as the “Luca stealer” and the “eternity
stealer”. The latter is part of an end-to-end offering named
the eternity project^[2], which allows threat
actors to buy or rent any tool they need to launch an attack
against a target of their choosing.

Stolen or compromised credentials were the primary attack vector
in 19% of breaches in the 2022 study and also the top attack vector
in the 2021 study. This trend is most likely to keep in its upward
trajectory as a whopping 59% of organizations don’t deploy
zero-trust, incurring an average of 1 million USD in greater breach
costs compared to those that do deploy. Until organizations’
cybersecurity will mature, the volume and cost of breaches will
continue to rise.

A rise in zero-knowledge attacks

Cybercrimes such as DDoS, malware, and ransomware are all
offered as subscription services, lowering the entry barrier into
cybercrime. For example, per the Microsoft Digital Defense Report
2022, phishing kits are offered on the dark web from as little as
$6 and DDoS attack subscriptions for as little as $500. Ransomware-as-a-Service^[3]
offered as an affiliates model is the preferred method by actors,
this means “renting” an already made operation and splitting the
revenue based on income and activity. The rise of “clearnet malware”^[4]
– malware that can be purchased on everyday platforms like Telegram
(Hello again eternity project!) helps simplify setting up a
cybercrime campaign or operation. The proliferation of crypto
payment platforms makes it even easier to trade in cybercrime
products and services, pushing the entire cybercrime ecosystem even
further.

Younger threat actors – average age will continue to
drop

In terms of cyberattacks, 2022 was Gen Z’s time to shine,
leading with UK teen group Lapsus$ that went on a hacking spree
targeting tech titans like Microsoft, Nvidia, Samsung, Ubisoft, and
Okta. Generation Z is currently the largest generation on earth.
Besides their strength in numbers, they are “digital natives”,
being born into a world with the internet, smartphones, cloud
technologies, and social networks. Being young, they naturally
crave social validation which they get in the digital sphere.
Lapsus$’s main motivator was “Kudos” – they were “doing it for the
lulz”. The ease of launching zero-knowledge attacks, combined with
Gen Z’s digital nativeness and their need for social validation in
the digital sphere will most likely contribute to the continuous
drop in the average age of cyber criminals.

We’ll still need humans in the loop

Enterprises invest billions of dollars deploying multi-layered
security frameworks, platforms, and programs, but at the end of the
day, enterprises are made of people, and people can be tricked.

Social engineering is an increasingly popular tactic used by
cyberattackers to gain access to sensitive data. It involves
exploiting human psychology to manipulate victims into providing
confidential information or taking certain actions in order to gain
access to a system or network.

LAPSUS$’s modus operandi was based on a text-book sim swapping
scam. They bought credentials of the person with the right access
to resources within an enterprise, called the phone provider,
reporting the phone stolen, rerouted the sim to their own phone,
triggered multi factor authentication on an enterprise access point
(e.g. Office365 login page), and did a password reset. It was
ridiculously simple and devastatingly efficient.

The best technology in the world can’t completely remove the
risk of human vulnerability. For that you need other humans trained
in that. The cybersecurity workforce gap compelled enterprises to
outsource this part of their cybersecurity to a managed detection
and response (MDR) service. In fact, (according to
Reportlinker.com) the global MDR market size is expected to grow
from an estimated value of 2.6 billion USD in 2022 to 5.6 billion
USD by 2027, at a Compound Annual Growth Rate (CAGR) of 16.0%.
Technology is great, machines are great, but we still need
humans.

Join Ronen Ahdut, Head of Cyber Threat Intelligence at Cynet for
a webinar “The Rise of the Rookie Hacker – a new trend
to reckon with^[5]” on January 11th at 10AM
ET / 15:00 GMT. The webinar will deep-dive into 2023 cybersecurity
trends, threats, and technology, including the need for human
oversight in cybersecurity and how to detect these new threats.