Clout chasing, traditionally the realm of influencers, is being encroached on by the cybercriminals of the world. This is according to analysis from Kaspersky’s Security Services as it provides guidance on the threats businesses will face in 2023.

The firm outlines a few emerging threats that it believes will rise in prominence over the course of the next 12 months. One threat vector in particular jumped out at us – clout-chasing cybercriminals.

News of a breach can garner headlines incredibly quickly. The danger here is that unless information comes directly from the company involved in the breach, it could be bunk.

“Blog posts about extortion attract media attention, and some lesser-known actors might take advantage of this in 2023, by claiming they have allegedly hacked a company. Whether the hack actually happened or not, a leak report might hurt the business. The key to staying safe is to identify these messages in a timely fashion and initiate a response process similar to that used in information security incidents,” Kaspersky’s Security Services outlines in its analysis.

This is rather frightening as a breach is a big deal not only for the affected company but its clients as well. The danger here is that if a company doesn’t move fast enough on the back of news of a breach – fake or real – it could cause chaos and breed mistrust in that company.

All the while clout chasing hackers are racking in new clients. Granted, this trust goes both ways as if the cybercriminal can’t back up these claims with proof their success in the underworld will be shortlived.

Fake breaches are just one of the concerns Kaspersky has highlighted.

This year, the cybersecurity firm anticipates extortion will become more popular. In 2022, Kaspersky saw the number of blog posts from cybercriminals increase dramatically. These blog posts boasted about breaches and – most concerningly – of extorting their targets with threats of the data that was stolen being published.

“Cybercriminals used to reach the victim directly, but now they post about the security breach in their blogs immediately, setting a countdown timer to the publication of the leaked data instead of privately demanding a ransom. This dark trend will continue developing in 2023 because this tactic benefits cybercriminals whether the victim pays up or not. Data is often auctioned, with the closing bid sometimes exceeding the demanded ransom,” says Kaspersky.

Extortion has been incorporated into ransomware for a few years already and with that in mind, it is best to access disaster recovery processes with regularity.

One trend that also rose in prominence throughout 2022 and is set to continue this year is malware-as-a-service. It’s also interesting to note that groups such as LockBit which peddle ransomware, have a code of ethics. As reported by Bloomberg in July, LockBit forbids its customers from using malware to “encrypt files for critical infrastructure and medical facilities where damage to the files could lead to death.”

Of course, other threats are always about but the above are some of the more popular attack vectors Kaspersky predicts will continue to hassle information security teams this year.

It gets more worrying

In its Threat Predictions for 2023(PDF), FortiGuard Labs highlighted the arrival of so-called Q-Days. The Q here represents quantum as in quantum computing.

While still in its infancy, quantum computing has the potential to trivialise current encryption methods.

“FortiGuard Labs notes that the security community is working to create new encryption algorithms designed to stand up to quantum computers, but this effort is still ongoing. A NIST contest for new post-quantum encryption algorithms saw one encryption, Supersingular Isogeny Key Encapsulation (SIKE) suffering a cyberattack from a single-core computer that successfully broke the encryption. FortiGuard Labs also warns that cyber criminals may start using quantum computing for additional activities,” says Doros Hadjizenonos, regional director at Fortinet.

There is not much that businesses or indeed ordinary folk can do about this right now, but it’s a threat that we should be cognizant of.

Businesses with Web3 aspirations should also be cautious about threats in that space. As Hadjizenonos points out, Web3 is very much about the user being in control of their data and users are one of the weaker links in the cybersecurity chain.

Nearly a year ago $1.7 million in NFTs was stolen from 32 Opensea users in a phishing attack. This could be a disaster for a business that has set up shop in a metaverse.

What both Fortinet Labs and Kaspersky’s Security Services highlight however is just how agile the cybercrime space is. As new advancements in technology become more widely available, we’d do well to consider how they can be used against us.

[Image – Georgia de Lotz on Unsplash]