Since December 16, 2024, Arctic Wolf has observed increased activity in a social engineering campaign associated with Black Basta ransomware. In this campaign, threat actors were observed using Microsoft Quick Assist and Teams to impersonate IT personnel and engage in malicious activities upon contacting victims. This is a continuation of the Black Basta campaign we reported on in a security bulletin sent in June 2024.

The Kroll Security Operations Center (SOC) has recently detected and remediated a trend of incidents that involved socially engineering a victim into pasting a PowerShell script into the “Run” command window to begin a compromise. These incidents have typically begun with the victim user attempting to find “YouTube to mp3” converters, or similar, then being redirected to the malicious webpages.

A social engineering attack is a form of cybersecurity attack where attackers approach individuals and psychologically manipulate them into divulging sensitive information or performing actions that compromise security. Unlike traditional hacking methods that exploit system vulnerabilities, social engineering preys on human psychology, using the likes of deceit, urgency or trust to bypass defenses.

Over a decade ago, I noticed that social engineering was the primary cause for all malicious hacking. It has been that way since the beginning of computers, but it took me about half of my 36-year career to realize it. At the time, I think everyone in cybersecurity knew social engineering was a big part of why hackers and their malware programs were so successful, but no one really knew how big.

When it comes to data loss, the biggest yet common dangers these days come from within the organization, and social engineering and insider threats are one of the main reasons. This shows that human mistakes are just as risky as external attacks. In this piece, you’ll see how social engineering and insider threats result in data loss. In addition to that, you’ll look at real examples to understand the seriousness of such threats and talk about steps companies can take to protect themselves.

Phishing remains a top initial access vector for cyberattacks, according to researchers at Cisco Talos. The researchers have published a report on threat trends in the third quarter of 2024, finding that attackers are increasingly targeting valid accounts to gain footholds within organizations.

The availability of deepfake technology has given threat actors a valuable tool for social engineering attacks, according to researchers at BlackBerry. “Typically, online scams prey on the presumed weaknesses and susceptibility of the targeted individual,” the researchers write.