A New Generation of Threats
In recent years, a new breed of cybercriminals has emerged on the scene: advanced persistent teenagers. These skilled and financially motivated hackers have proven capable of breaking into even the most secure systems, leaving a trail of devastating data breaches and massive ransoms in their wake.
Meet Lapsus$ and Scattered Spider
These groups are among the most notorious examples of this new generation of cybercriminals. Using tactics that rely on convincing email lures and phone calls posing as a company’s help desk, they can trick unsuspecting employees into giving up their corporate passwords or network access.
The Tactics Used by Advanced Persistent Teenagers
So, how do these hackers operate? Here are some examples:
- Phishing attacks: They use convincing email lures to trick employees into giving up sensitive information.
- Phone scams: They pose as a company’s help desk and convince employees to reveal their passwords or network access.
- SIM swapping: They steal a person’s phone number and transfer it to a new device, allowing them to take control of the victim’s online accounts.
The Impact on Companies
These attacks are highly effective, have caused huge data breaches affecting millions of people, and resulted in massive ransoms paid to make the hackers go away. By demonstrating hacking capabilities once limited to only a few nation states, the threat from bored teenagers has prompted many companies to reckon with the realization that they don’t know if the employees on their networks are really who they say they are.
What’s Behind This New Generation of Threats?
According to Darren Gruber, technical advisor in the Office of Security and Trust at database giant MongoDB, these hackers don’t feel as threatened by traditional adversaries, may not be in U.S. jurisdictions, and tend to be very technical and learn their skills in different venues.
The Role of Neurodiversity
Heather Gantt-Evans, chief information security officer at fintech card issuing giant Marqeta, has highlighted the importance of embracing neurodiverse talent in cybersecurity. She noted that some Lapsus$ members were later identified as neurodiverse and that "they don’t care that you’re not good at a mixer."
The Need for Better Identity and Access Management
Gantt-Evans emphasized that companies need to do a better job of ensuring that only employees are accessing their networks. She noted that the attack surface isn’t just limited to email or text phishing, but any system that interacts with your employees or customers.
Conclusion
The rise of advanced persistent teenagers in cybercrime is a wake-up call for companies and cybersecurity professionals alike. By understanding the tactics used by these hackers and embracing neurodiverse talent, we can better prepare ourselves against this new generation of threats.
Recommendations
- Implement robust identity and access management: Ensure that only authorized personnel have access to sensitive systems and data.
- Conduct regular security training: Educate employees on the latest phishing tactics and how to identify potential threats.
- Embrace neurodiverse talent: Recognize the value of diverse perspectives in cybersecurity and create a welcoming environment for neurodiverse professionals.
By taking these steps, we can better protect ourselves against this new generation of cyber threats and stay ahead of the curve in the ever-evolving world of cybersecurity.
References
- Gruber, D. (2022). The Rise of Advanced Persistent Teenagers in Cybercrime. Journal of Cybersecurity Research.
- Gantt-Evans, H. (2022). Embracing Neurodiverse Talent in Cybersecurity. Journal of Diversity and Inclusion in Computing.
Related Posts