ESET’s APT Activity Report shows that the North Korea-aligned threat actors have significantly refined their tactics, making traditional security advice like “don’t click suspicious links” increasingly inadequate as attacks become more convincing and personalized. According to IBM’s Cost of a Data Breach Report 2024, conducted across 604 organizations in 16 countries, the average business loss from a phishing-related breach has reached $4.88 million, making it the second costliest attack type behind malicious insiders at $4.99 million. Rather than immediately sending malicious content, they invest time cultivating trust with potential victims, making detection considerably more difficult for both individuals and automated security systems. The most effective defense combines employee education with multilayered security solutions, creating a prevention-first approach that minimizes the attack surface while reducing the complexity of cyber defense. Verizon’s 2024 Data Breach Investigations Report reveals that 68% of breaches involved a non-malicious human element, such as falling victim to social engineering or making a mistake. Cybercriminals are advancing beyond rudimentary phishing attempts, adopting sophisticated social engineering strategies that build relationships with targets before delivering malicious payloads. Subsequently, attackers pose as IT support staff, contacting employees via Microsoft Teams and sending malicious QR codes designed to deliver remote monitoring tools that can be exploited for network access. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. North Korea-aligned groups exemplify this trend, with ESET researchers observing groups like Deceptive Development and Kimsuky enhancing their phishing campaigns through elaborate pretexting methods during Q2-Q3 2024. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Most concerning is the shift toward pretexting—using fabricated narratives to gain trust—which now surpasses traditional phishing in breach statistics, indicating threat actors’ growing sophistication. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. The Lazarus group has implemented similar tactics, distributing fake job opportunities at major corporations such as Airbus and BAE Systems, simultaneously delivering trojanized PDF viewers with decoy documents. ESET analysts noted that this evolution toward relationship-based social engineering represents a significant paradigm shift in how attackers operate. These actors initiate contact through fake job offers at prestigious companies, and only after establishing communication do they deliver malicious packages to unsuspecting victims.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 10 Mar 2025 06:25:08 +0000