The cybercrime trends to watch out for in 2024

Most security leaders agree that 2024 will bring bigger challenges for security teams. Why? The interplay of AI-driven cyberattacks and the maturation of cybercrime into a professional industry is making attacks more complex and difficult to target. Hacktivism, cyberattacks amid global crises, and disinformation campaigns contribute to the complexity, placing an additional strain on cyber security teams already grappling with burnout.

Aware of the challenges security teams are faced with, attackers continue to take advantage of the opportunity, setting the stage for a year that is predicted to have a record number of cyberattacks targeting the human factor. But it’s not just a numbers game anymore. It’s about how sophisticated these threats have become. Preparing requires knowing, so stay with us as we dig into the top cybercrime trends you should watch out for in 2024.

Trend 1: We are yet to see the full impact of generative AI in cybercrime

In 2024, the transformative impact of AI on cyber security will take center stage, building upon the momentum of the preceding year. In 2023, malicious actors harnessed tools like WormGPT to not only enhance the speed at which they create content, such as phishing emails, but also to increase the sophistication and effectiveness of their attacks. However, this is merely the tip of the iceberg, as the accessibility and commercialization of AI increases, with projections expecting over 300 million users in 2024 and 700 million by 2030.

This democratization of AI technology has lowered the barrier of entry for cybercriminal activities and increased the potency of multichannel attacks. Technologies like deepfakes and voice cloning are now widely available. Recently, attackers used a voice clone of a teenage girl to demand a $1 million ransom from her mother. The rapid progress of generative AI, as seen in ChatGPT’s ability to interpret images, introduces new concerns like prompt injection and the ability to bypass CAPTCHA codes. Multi-factor authentication (MFA) is also becoming susceptible to AI attacks, as shown in the incident at Retool, where attackers claiming to resolve a payroll issue posed as the IT team and tricked an employee into sharing their credentials on a fake landing page. Later, using the AI-generated voice of an IT team member, the attackers asked for the OTP token to bypass Multi-Factor Authentication (MFA). This complex plan enabled them to take over 27 customer accounts and steal valuable cryptocurrency.

With examples like these already happening at the beginning of 2024, we are sure that we have yet to see the full impact of AI in both cybercrime tactics. Security teams around the globe are also working hard to see how they can leverage the same tools to their advantage. It is a matter of time to see who wins the race.

Trend 2: Hacktivism and digital dissent escalate in a fragmented world

Global instability has spurred a surge in both cybercrime and incidents involving hacktivists, who launch targeted cyberattacks aligned with their political or social motivations. The growing hacktivism trend, which increased by 27% in 2023, is expected to increase even more in 2024, especially in the context of the growing geopolitical tensions and conflicts. In fact, the more recent conflict between Israel and Gaza highlights the escalation and further implications of this threat.

But hacktivism is not solely confined to political or warfare contexts. It also extends to social causes. The recent cyberattacks on Scandinavian Airlines by Anonymous Sudan in response to a far-right nationalist group’s actions and the VulzSec hacking group compromising French police data in retaliation for police brutality are stark examples of some of the possible motivations behind the activities of hacktivists.

This symbiotic relationship between hacktivists and cybercriminals creates a complex cyber threat landscape where vulnerabilities exposed by one faction are exploited by the other. With such a high number of cyberattacks coming from several sources and motivated by different reasons, organizations will struggle to identify who is targeting them and, in turn, how to adapt their cyber security strategies accordingly.

Trend 3: Disinformation-as-a-Service to become a crucial tool in hackers’ arsenals to destabilize organizations

“Disinformation-as-a-Service” (DaaS) is becoming a pivotal tool for hackers, especially in destabilizing governments and organizations. This tactic, which involves the deliberate spread of false information, is increasingly being used by many different actors to manipulate public opinion, damage reputations, and influence business and political landscapes. We saw this in the Slovakian elections, where attackers used an AI-generated deepfake audio to spread disinformation. Now, as the US elections approach, there’s a real concern that similar tactics could be used to influence public opinion and affect voting decisions.

Beyond political agendas, financially motivated cybercriminals are expected to leverage DaaS to destabilize organizations and harm their reputation. CEOs, who are often targeted because of their high visibility, are especially at risk. Since it’s quite simple for hackers to obtain their voice or video clips, these can be twisted into making shocking statements that can hurt the image of the businesses they lead.

Trend 4: Exhausted defenders: Rising burnout rates will challenge cyber security teams like never before

The increasing sophistication of cybercriminals and the use of AI tools to launch more complex and convincing attacks, combined with escalating global tensions, are fueling an increase in attacks and testing the resilience and adaptability of security teams. Security teams, who were identified as one of the most vulnerable departments to cyberattacks in our Human Risk Review 2023, report heightened stress levels due to escalating cyber security threats. This is further complicated by the alarming shortage of skilled cyber security professionals, with 3.9 million unfilled positions worldwide. The workload for existing teams has led to high stress levels, with surveys indicating that 66% of security team members experience significant work-related stress.

This pressure not only impacts their personal well-being but also increases the possibility of making mistakes and overlooking security breaches. Cybercriminals will continue to exploit this vulnerability in 2024 by specifically targeting exhausted security teams. But not everything is lost: companies can weather the storm by establishing solid career plans to boost employee retention, thus preventing their teams from being understaffed and overworked.

Trend 5: 2024 will be a year of security challenges for the public sector and critical infrastructure

The public sector has become a prime target for hackers. The sensitive information they handle, their outdated systems, and the reduced security budgets have placed this sector at the top of the most-targeted sectors list by the European Agency for Cybersecurity. And when it comes to public entities, even the simplest attack can have far-reaching consequences. In fact, the average cost of a cyberattack in the public sector mounted to an alarming $2.60 million in 2023, according to IBM’s Cost of a Data Breach 2023.

With cybercrime becoming more professionalized and political tensions fueling state-sponsored attacks and hacktivism, special pressure is placed on critical infrastructure. Not only do these organizations suffer the tremendous financial loss of cyberattacks, but they can also lose control over the sensitive data of thousands of people or even suffer severe disruptions that could potentially endanger lives.

Hackers know that the security resources in the public sector are limited, resulting in organizations not having strong security strategies in place. For example, a report by ENISA revealed that only 27% of healthcare organizations have a dedicated ransomware defense program, and 40% of healthcare organizations lack a security awareness program for non-IT staff. This puts them in a vulnerable position where even a minor cyberattack can disrupt their systems and have devastating consequences.

As we see how cybercriminals, hacktivists, and state-sponsored threat actors increasingly target public sector organizations, the need to allocate enough resources to develop a strong security strategy becomes clear. Only when the right measures are put in place will we be able to move towards a safer digital world where public organizations and critical services are protected.

More cybercrime trends: What else is to come?

The trends highlighted above shed light on some of the main threats we expect to see in 2024, but there’s more. AI-powered disinformation campaigns are on the rise as deepfakes and voice cloning become more realistic, new technologies like quantum computing and 5G open new avenues for threat actors to exploit, and pretexting and multichannel attacks allow hackers to craft more personalized and convincing threats.

To learn more about how these other trends will shape the future of cyber security in 2024, download our full Cybercrime Trends report.

Throughout 2024, expect more breaches that involve the human element

2024 is the year where not only cyber threats are going to skyrocket, but they are also going to become more convincing than ever. The unstoppable wave of attacks will affect all organizations – no matter their size or the sector they belong to. AI and the professionalization of cybercrime will lower the bar to becoming a cybercriminal, while political tensions keep fueling an already complex threat landscape.

In 2023, a staggering 74% of breaches involved the human factor, and this trend is only going to continue to grow this year. Increasingly convincing cyber threats, coupled with sophisticated social engineering tactics like pretexting and multichannel attacks, will make cybercrime more efficient and dangerous. This will result in more breaches linked to the human factor and a compelling need for organizations to establish a solid human risk management strategy.

It’s time to start seeing your employees as more than a target: they can become key defenders of your organization. But for that to happen, security awareness training focused on human behavior is key. SoSafe’s human risk management platform is not only a gamified, behavioral-science-based awareness training program. It’s also an integral platform dedicated to measuring and managing human risk that allows you to monitor specific metrics and KPIs to measure real behavioral change.