2024 Threat Trends

0:00:01.4 Max Havey: Hello, and welcome to another edition of Security Visionaries, a podcast all about the world of cyber, data and tech infrastructure, bringing together experts from around the world and across domains. I'm your host, Max Havey, and today we're taking a look back at some of the big threat trends of 2024, and looking ahead at what may be on the horizon in 2025 with our guest, Ray Canzanese, director of Netskope Threat Labs. Ray, thanks for joining us.

0:00:25.1 Ray Canzanese: Oh, thanks for having me, Max.

0:00:26.8 Max Havey: All right. So Ray, I'm gonna ask you some questions here about what you've seen over the past 12 months, and I'm hoping that you can use a mixture of some direct insights from your own research at Netskope, and also share some knowledge from your wider engagement and collaboration with the broader threat community. So, to start off, there's been a lot of talk about how AI is changing security. So let's start by asking, have you seen threat methodology that's been changed by AI this year?

0:00:54.2 Ray Canzanese: I guess AI has been changing cybersecurity since its inception. Cybersecurity is newer than AI. We've seen it since the beginning. It started with heuristics, then machine learning, which continued to become more and more advanced. Now GenAI. So, of course, it's changing the industry as it always has. In the past year we saw GenAI tools being way more heavily used by attackers. They've become really useful tool for social engineering and scams. We've seen lots of fun, deep fake celebrity endorsements. You've got some celebrity selling something. All you have to do is give it your social security number, all your bank account information, all your credit cards, and that of all your friends. And then you'll get, I don't know, whatever weird new invention they're selling. We've seen fake CEOs requesting help from employees. For business email compromise and other types of attacks. We also have found that some enterprising attackers decided they could sell their own LLMs. And so we have LLMs being sold that are specifically used for things like business email compromise, and inherently nefarious things.

0:02:09.7 Ray Canzanese: On the other end of the spectrum, we see all of the new technology being used by defenders as well, especially with LLMs, which are really good at taking massive amounts of data and making it easier to understand. That's the perfect tool for cybersecurity. All of us cybersecurity professionals are drowning in data, more data than we will ever be able to look at. And so having tools that can examine that data, summarize that data, and give us something we can quickly understand, that's a fantastic tool for a security professional. And so the other thing I guess, that AI has changed, is there's now a new class of tools that we all have to worry about as cybersecurity professionals. So not just worried about all of the good and bad that come with the GenAI tools, but also what about the tools themselves? Are they being used safely and securely? What types of data is being sent to them? Was the data that they were trained with poisoned? Is it accurate? How are people using the outputs? All of these fun new challenges coming with GenAI as well.

0:03:17.1 Max Havey: Absolutely. And were there any specific threats or campaigns that stuck out to you in reviewing research from this year specifically around people abusing generative AI tools or finding some of those weak points in tools?

0:03:30.0 Ray Canzanese: Well, as far as using the tools go, I think all of the social engineering where there was some deep fake. Either somebody's voice, a video of them, somebody joining a Zoom call, all of those to me really tie as the most convincing use of AI to build a social engineering bait that people honestly just weren't really well equipped to deal with. You're trained to hover your mouse over a link and see where it truly goes. What do you do when you get a phone call from Sanjay Barry, my CEO, and he's like, "Ray, quick, give me the bank account numbers, we need to transfer some money." There was no training that prepared me for that. And so all of those types of social engineering attacks are just really, really novel and make us rethink what we need to do in response.

0:04:23.0 Max Havey: So it's a new frontier in all of that, and it takes learning how to identify those sorts of things that seem fishy in the general sense, not just the pH sense, but like what should people be looking out for when it comes to identifying those sorts of generative AI-enabled deep fake sort of social engineering ploys?

0:04:41.1 Ray Canzanese: Yeah, it's a good question, and I think it's not a simple question either. 'cause if you were to ask me 20 years ago, what should people look out for in phishing emails, I can tell you what people should look out for in phishing emails. And then we fast forward 20 years and what's happening, people are still clicking on links and falling for phishing emails. There's already so much burden on the individual human already to make these decisions. So you tell them like, "Well, you should think more critically when you get a call from Sanjay Berry. Does Sanjay normally call you? Does he normally ask you for bank account numbers?" And you say, "No, he doesn't normally do those things, I shouldn't fall for this." Or, "Is that really Elon Musk on YouTube right now asking me to give him $10,000?" No, Elon Musk doesn't need $10,000 from you. So you ask people to think more critically about those things, but the burden's also on those working in the cybersecurity industry. How do we lower that burden on the individual? To what extent can we just help them never see these scams, these phishing links, and to what extent can we just help them make more informed decisions.

0:06:00.2 Ray Canzanese: I will never wholly know what is going on in your life when you are browsing the web and you are about to answer a phone call or click on a link. But I know something about the provenance of where that link came from, the likelihood that it's real. And to the extent that I can help you, that I can give you information that says, be careful when you're on this phone call, while I'm not really sure it is who it says it is, that makes things just a little bit easier on the human and hopefully makes us all a little bit more secure.

0:06:36.0 Max Havey: Definitely, is having those tools in the right place and knowing how to use them and how to apply them in those situations where you don't have a cybersecurity professional looking over your shoulder at all times.

0:06:46.3 Ray Canzanese: Right. And I was sort of anthropomorphizing myself as a cybersecurity tool there, but the concept is valid. It's that when you're using these tools, it's like somebody sitting there, watching what you're doing and trying to help you out, but they don't know everything. They don't know all the context about what you're doing, who you normally interact with. And so there's always a gray area. And helping the human deal with that gray area is something that we as cybersecurity professionals can do better about. When it's black and white, it's easy. When we can say, "Yes, this is definitely good, and yes, this is definitely bad." We can pat ourselves in the back for the win, but there's always that gray area, and that's the tough one.

0:07:29.6 Max Havey: Certainly. Have you seen these evolving threat trends around AI reflected in organizational changes in the way that they secure AI or they use AI for security? How is that, how have you seen that sort of evolve this year?

0:07:41.3 Ray Canzanese: Yeah. I think that 2024 was interesting, in comparison to 2023, I think 2023 was the year of like, AI in everything. Like, can you imagine how much better my toilet would be if it had AI? And in 2024, we seemed to have realized that you don't need AI in everything. And that if you tell me no, when I ask if I need to use 90 different AI apps to complete my job, that's an okay answer. 'Cause it turns out I don't need 90 different AI apps to be effective at my job. And so 2024 seemed to be the year of like the tightening of the screws. We saw more organizations just exert more control over what was going on. We saw the number of blocks increasing the, "We've decided that you're only allowed to use these three apps and we're gonna block all the others." That became a more common strategy.

0:08:33.9 Ray Canzanese: The other thing that we really saw increase is that organizations who said yes to AI, which is the overwhelming majority of them, like above 94%. Now I think, it's, "Yes, but. " and they've put a lot of DLP controls around the AI apps. Specifically, they are looking at what people are posting and saying, "Well, is it regulated data? Is it secrets? Is it source code? Is it anything I don't want leaving my protected boundaries?" And if it's not either just stop you from doing it and say no, or do some to my earlier point, some coaching and say, "Hey, this looks like you're about to post something that looks like regulated data to ChatGPT. Are you sure?" Because we recommend that you don't do that. So you sort of empower the user when there's a gray area there to make the right choice.

0:09:34.2 Max Havey: Absolutely. Having those sorts of stop-gaps and catching people in the nick of time before they do something like uploading corporate secrets to ChatGPT or something of the sort.

0:09:43.4 Ray Canzanese: Right, right. 'Cause the answer might be that while this might look like a corporate secret to you, it's not really a secret. And I know that, and so I'm happy to continue, but we do find that that sort of strategy of just in-time coaching is a very effective one. The amount of times that somebody decides to continue after they've been prompted with a "Are you sure" type message is, it's less than half. It's a pretty effective control just to give somebody a gut check and ask them, "Are you really sure about this?" Just don't do it every time they click on anything. Make sure you're asking that question sparingly so it can maintain its effectiveness.

0:10:26.4 Max Havey: Absolutely. So not to inundate them, but just in the most important circumstances.

0:10:30.2 Ray Canzanese: Right, right. Like, "Are you sure you want to visit this website? Are you sure you want to click on that link?" You can see how that would very quickly get annoying. And your answer is just always automatically, "Yes." Because the answer is really just leave me alone, I'm trying to work here.

0:10:46.3 Max Havey: Well, Ray, to shift gears here slightly, I've seen a lot more articles this year in the media about cyber threats and usually talking about the actions of nation state actors. I wanted to get a sense, did your research team pick up on any notable nation state cyber attack trends this year? And if so, what were those?

0:11:04.6 Ray Canzanese: In general, the nation states, we saw where we had the most APT activity against our customers. And again, our customer base is global. We have customers in all continents, it was the usual parties. Russia, North Korea, Iran, China, were the top four by a big margin. Not really surprising because geopolitical cybersecurity activity is generally just a reflection of broader geopolitical trends. And so where you see conflicts, that is where you're going to see cybersecurity activity as well. And active APT groups. The second trend we saw there, we saw a lot of initial access brokers being very active. These are organizations whose specialty is just the infiltration, find a way in and then sell that way in to somebody else who has something they want to do with that way in. So this is part of that, like specialization within the adversary community. We saw lots of common tooling whenever there's a tool like Cobalt Strike, very powerful and effective command and control framework that has been hacked and modified so many times that it seems everybody's using it. So we see these common tools in terms of common trends, rather in terms of which tools are being used.

0:12:30.0 Ray Canzanese: And then I guess the sort of final trend that we saw was that, in addition to this like traditional, let's call it cybersecurity activity of phishing and infiltration attempts and hacking and ransomware and all that stuff, we saw a lot of disinformation, a lot of espionage, a lot of attempts at destabilization, a lot of attempts at division. A lot of this happening in social media. And so you not only have this traditional cybersecurity activity, but you have a lot of this other stuff that's more out in the open and affecting everybody. And so it's just... To the earlier point of what do we expect out of the individual? And the individual is so overwhelmed. There's just so much noise. I don't know that I had to think so hard in my past about whether something I was reading in the news was true or not. And so we've just added so much more cognitive burden to everybody, and it's just making the cybersecurity landscape all that more challenging.

0:13:33.1 Max Havey: Absolutely. And looking ahead, how do you expect these sorts of nation state trends to evolve in the coming year? Will it be the same nations? Do you expect these methodologies to evolve at all? What sort of your perspective on that?

0:13:45.7 Ray Canzanese: Sure. In terms of what nations it's going to be, that's highly dependent on the geopolitical landscape. And I'm no expert in geopolitics, but I have been alive for a while and some things seem to have not changed in my lifetime. And so I don't really expect the geopolitical landscape to change very drastically in terms of where the conflicts are in the world over the next year. So I expect a lot of the same regions to be active in terms of APTs. I expect all this disinformation, destabilization, division to continue. It's seemingly effective. It's a really good... By good, I mean effective. Effective use of social media.

0:14:27.9 Max Havey: Yes.

0:14:28.2 Ray Canzanese: Definitely not a good use of social media. The other thing that I expect we will see is continued attacks on industries that have not historically invested in cybersecurity. We can't have a conversation about APT groups without talking about Salt Typhoon. So what did we have in the past year or two? We had Salt Typhoon going after the telecommunications infrastructure really throughout the world. And one of the common themes in the response from the telco companies when asked what's going on? And it's, "Well, we built these systems for efficiency, for availability. We didn't build these with modern cybersecurity concerns in mind." And so I expect to see more of that. You expect to see more of these successful infiltrations that go undetected for a long time because the cybersecurity infrastructure was not built in to that product or that industry from the beginning.

0:15:28.7 Max Havey: Definitely. We had Kiersten Todt on our previous episode talking about her predictions for 2025 and talking about Salt Typhoon and expecting, I think more things in that vein looking ahead seem to be pretty high on her mind as well.

0:15:42.0 Ray Canzanese: Yeah, absolutely. There's a lot of us spending a lot of time trying to learn every lesson we possibly can from what happened with the telco industry and Salt Typhoon.

0:15:52.3 Max Havey: Almost certainly. And shifting gears again slightly, were there any specific threat trends this year that you saw that surprised you the most?

0:16:01.1 Ray Canzanese: Yeah, it's really hard to be surprised when you've been doing this long enough, but there was something that surprised me a little bit, and it was that we actually saw more people clicking on phishing links this year compared to last year. And the reason, again, we talked about this a little bit, the reason I find that so surprising is that we spend so much time, and phishing seems to be such a core message when we do cybersecurity awareness training, how to spot a phish, how to avoid clicking on a phishing link. And so to see it really like roughly double year over year was a little like, "Oh no, what are we doing wrong?" And on the other hand, the reason it's not surprising at all is because it's everywhere now. The training says you receive an email. Make sure you scrutinize your email. But if you look at where people are clicking on these links for scams and phishing links, it's not email. They're clicking on links in social media, ads, search engine results, DMs they receive through messaging apps. It's just everywhere. And when something is everywhere, it becomes a lot harder to avoid. And that's, I think really what we've been seeing is just the inundation of phishing coming from every angle. You're eventually gonna catch somebody off guard, and they're eventually gonna click on one of those links. And unfortunately we had more people than usual doing so.

0:17:32.1 Max Havey: Yeah. It's what happens when it turns into a numbers game, it's all quantity. And when you're getting it from DMs and text messages and phone calls and elsewhere, it's difficult to avoid it.

0:17:42.2 Ray Canzanese: It's difficult to avoid it without like completely disassociating. Like I could never click a phishing link if I never clicked a link in anything that anybody ever sent me anywhere. And that's the problem. And so you're again in that gray area where I... "This seems legit. I'll click. I'll see what's going on here." And that's how we will always end up in this scenario.

0:18:06.3 Max Havey: Certainly. And I think to go back to your point talking about the individual, it reaches a point where it is no longer a thing that you can rely on the individual at all times to keep up with that, especially when it's at such a volume like that of without entirely going off the grid.

0:18:20.2 Ray Canzanese: Right. Yeah. And it's not like scams are a new thing. It's not like this is a new problem. The problem is the volume of other people that you encounter on the internet. And that you never know who's a real person when you're dealing with anybody on the internet.

0:18:39.1 Max Havey: Certainly. Well, Ray, we've covered a lot of ground so far, but are there any other specific threat trends that stuck out to you that we haven't covered off on quite yet?

0:18:47.7 Ray Canzanese: I guess the thing that really stuck out to me that we talked about a little bit was AI. And so we talked about like the strategy for control. Where we see more people blocking apps using DLP to control the flow of data there. The thing that stood out to me a little bit is that increasing trend of use hasn't really slowed yet. Throughout 2024, we saw a roughly tripling of the number of people in the enterprise using AI apps on the regular. It stuck out to me that that's continuing to rise, that we haven't really hit a plateau there yet, which means expect even more changes in the coming year.

0:19:32.2 Max Havey: Certainly. And that sort of brings me to my last real question for you, looking ahead at 2025, are there any major trends you see on the horizon that is coming from the research and the conversations you've been having with other folks in the threat community?

0:19:44.5 Ray Canzanese: Yeah, really for me it's this human element. If the human is at the center of cybersecurity risk and the modern workplace now, in addition to all of the other tools and forces we had pulling at us now has GenAI and all of these deep fakes and well-crafted phishing links and fake login pages. It's become so much harder for individuals to make informed decisions about how to deal with sensitive data and security protocols. And again, like the volume is just way too high. We're asking too much of too many people. And so for me, I think the trend is that we'll continue to see the disinformation, destabilization, division. We'll continue to see AI used for phishing and deep fakes and scams, and it's going to be a really challenging societal problem. It's not just a problem that organizations are facing. Like of course I'm worried about my employees, of course I'm worried about my data, but everybody is facing these challenges worldwide. And so I think that us rethinking use of those platforms and how to control use of those platforms to lower abuse is going to be a major topic in the coming year. I think from those of us in the cybersecurity industry who are looking to secure organizations, I think our focus needs to be and will be on lowering cognitive burden of users. How do we guide people toward making the right decision with less cognitive burden?

0:21:22.4 Max Havey: Absolutely. And I like that despite the fact that, I think you are correct in that we're gonna continue to see a lot of these darker trends continuing to thrive. The key here is finding a way to reduce that cognitive burden on the people, on the users who are encountering this every day. And that's also you and me 'cause we are also people. And I think finding better ways to deal with that is a really lovely prediction and a great way to enter the new year. That's a good resolution of some sort.

0:21:50.1 Ray Canzanese: Yes. Not an easy one, but a good area for us all to focus.

0:21:54.9 Max Havey: Certainly. Well, Ray, I think that does it for questions that I have on my end. Is there anything further that you'd like to add?

0:22:02.1 Ray Canzanese: Yeah, sure. Just a little plug.

0:22:04.0 Max Havey: Oh yeah, go ahead.

0:22:04.4 Ray Canzanese: You can find out more of the things we're working on at netskope.com/threatlabs. I have a monthly newsletter you can sign up for. I'm on LinkedIn and I also just recently joined Bluesky as well. So you can find me in all of those places.

0:22:21.4 Max Havey: Excellent. Well, Ray, thank you so much for joining us here today. This is always a delightful chat when I can talk threat trends with you, and especially when we can find a little bit of hope in that conversation as well. So, thank you so much for joining us here today.

0:22:32.1 Ray Canzanese: Absolutely. Thanks Max. Take care.

[music]

0:22:34.0 Max Havey: All right. You've been listening to the Security Visionaries podcast and I've been your host, Max Havey. If you've enjoyed this episode, share it with a friend and subscribe to Security Visionaries on your favorite podcast platform. There you can listen to our back catalog of episodes and keep an eye out for new ones, dropping every month, hosted either by me or my co-host, the wonderful Emily Wearmouth. And with that, we'll catch you on the next one.