2023 Prediction: Cyber Criminals will exploit the Cost-of-Living Crisis

Guest post by Integrity 360’s Principal Architect Zach Fleming

Whenever there’s an opportunity, cyber criminals will exploit it. In 2023, the global economic outlook is not bright and the cost-of-living crisis is providing cyber criminals with the perfect opportunity to increase their scam attempts and exploit people who are struggling financially.

Fraudsters will step up phishing & ransomware is on the rise

We see an upsurge in the number of phishing emails every year during the holiday period as fraudsters take advantage of people seeking a bargain and shopping online, and home deliveries highest at this time of year. According to Check Point’s Brand Phishing Report for Q3 2022, the number of phishing emails impersonating delivery services will rocket with DHL replacing LinkedIn as the organisation most impersonated by scammers.

With the cost-of-living crisis set to dominate the headlines throughout 2023, cyber criminals will increase their efforts to target people worried about bills by sending phishing emails and texts claiming to be from government and local authorities that promise energy bill and council tax rebates, or emails encouraging people to apply for fake cost-of-living payments that mimic genuine government support packages.

In an attempt to increase their income, we can also expect an upsurge in ransomware attacks in 2023. With Ransomware-as-a-Service being readily available, it is likely that more people who previously would never have contemplated breaking the law will turn to cybercrime to bolster their bank balance.

The insider threat will increase

The cost-of-living crisis and a faltering economy will push many people to the brink financially in 2023 and cyber criminals know it. They also know that external security permitter controls are good, leaving them no option than to bribe employees and offer financial incentive to provide them with the credentials they need to breach a business.

For example, an employee of a company posts on a forum looking for opportunities and a ransomware gang responds. Details or access will be shared, after which the ransomware gang will send a phishing email with a malicious link to the employee who will then deliberately click it once received. As there is no penalty for poor cyber awareness, the insider essentially gets away with it and once the attacker has what they want, they will then pay the insider a cut of the ransom. 

Advanced Persistent Threat (APT) groups operate at a level of sophistication that will surprise anyone who doesn’t pay attention to cybersecurity. They have their own websites, job boards, benefits packages and (in some cases) HR departments. They operate like any other business and offer large financial incentives for those who help them. With the cost-of-living crisis expected to deepen over the course of 2023, we can expect to see a lot more instances of malicious insider threats as people struggling financially may turn to these groups to raise extra money.

Eliminate access for ex-employees

Another thing to consider is revenge attacks from former employees. Companies will no doubt be cutting costs and unfortunately when times are tough, often it is the employees who get cut first. Businesses therefore need to ensure they enact any layoffs in a way that won’t cause resentment or lead to former employees seeking revenge.

While this is easier said than done, it is possible to reduce some of the risks. For instance, ensure that access to company systems for a former employee is revoked and that any third-party applications they used in their job have the passwords changed. A Zero Trust policy will be of great benefit in ensuring that those who no longer work for an organisation cannot access company systems and networks.

Slashing cyber security budgets isn’t smart

Another major risk businesses will face during the economic downturn will be upper management’s desire to cut costs. Cutting budgets is an understandable reaction during a period of rising costs and reducing margins, but businesses need to remember that cybercriminals never rest. Slashing cyber security budgets can put a company at risk of losing their cybersecurity professionals (already in short supply) and can result in gaps in an organisation’s defences.

A more effective approach will be to get a full overview of your network and identify what is vital and what tools can you not operate without. Reducing cybersecurity capability doesn’t have to be the consequence of cutting budgets, but instead should be used as an opportunity to optimise and streamline what you do have.

Business leaders need to remember that effective cyber security detection and response is only possible if IT teams know what they’ve got to work with, and how users and data are interacting. They need continuous, accurate and up-to-date information to mitigate threats, navigate risks, and neutralise incidents. This where Managed Detection and Response Services come into play.

During times of financial difficulty, a company may struggle to afford to pay for in-house cyber security teams. With a Managed Security Service Provider (MSSP), a business doesn’t have to worry about requiring an in-house specialist to cover everything. It’s cost-effective as well due to an MSSP able to provide services and software for a fraction of the cost. MSSPs are more flexible too, allowing a business to scale at pace, confident in the knowledge they are protected from cyber threats.

With threats more sophisticated and more frequent than ever before, and the potential cost of a breach greater than ever given the unfolding economic situation, having an effective cyber security strategy in place has never been more critical. That means paying attention to the people who have access to company systems and implementing the technologies to safeguard the organisation. In turn, your business (and budget) will be better protected.

See more stories here.