There is a Ransomware Armageddon coming for all of us

Ransomware Armageddon


Generative AI will enable anyone to perform advanced phishing attacks that only next-generation MFA devices can stop

The least surprising headline from 2023 is that ransomware has once again set new records for number of incidents and damage caused. We saw new headlines every week, including a who’s-who of major organizations. If MGM, Johnson Controls, Chlorox, Hanes Brands, Caesars Palace and so many others can’t stop the attacks, how can anyone else?

Phishing-driven ransomware is the cyber threat that looms larger and more dangerous than all the others. CISA and Cisco report that 90% of data breaches result from phishing attacks and financial losses totaling more than $10 billion. A report from Splunk shows that 96 percent of businesses have fallen victim to at least one phishing attack in the past 12 months, and 83 percent have had two or more.

Generative AI

Those of us in the cybersecurity space have seen incredible progress in defense over the past two decades. The only thing that hasn’t progressed yet are the people. Users in every organization and not much more advanced in stopping cyber attacks than twenty years ago. This is why phishing is so effective for cybercriminals: because it exploits human weaknesses, not technology. Then the traditional MFA remains the most critical defense mechanism. And guess what: most companies are using older MFA technology that is also twenty years old.

This is why things will get much worse. With the rise of Generative Artificial Intelligence (GenAI), cybercriminals are able to take phishing to a whole new level, making each attack nearly impossible for users to identify, and attackers will now be able to do this with little effort. Read on to find out why and what you can do about it.

What does GenAI have to do with phishing?

Phishing uses deceptive communications (emails, text messages, and voice messages) to trick users into divulging sensitive information, including login credentials, passwords, one-time passwords, personal information, and clicking on fake approval messages.

Cybercriminal gangs are learning to harness the incredible power of GenAI tools like fraud versions of ChatGPT to create more compelling, persuasive, and realistic phishing messages. This highly personalized and context-aware text is virtually indistinguishable from normal human communication. And this makes it extremely difficult for recipients to tell the difference between real and fake messages. LLMs allow virtually anyone, not just hackers, to conduct phishing attacks.

Furthermore, traditional anti-phishing solutions are not effective in detecting the latest phishing messages created by GenAI. GenAI content lacks telltale signs of phishing, such as spelling mistakes or common language. Phishing detection tools rely on pattern recognition and known indicators of phishing that will no longer be present. Perhaps more worryingly, GenAI tools allow cybercriminals to conduct highly targeted phishing campaigns on a large scale. Threat actors can now automate the generation of a virtually unlimited number of customized phishing messages for a wide range of victims.

Changing tactics against phishing

The explosion of GenAI-powered phishing attacks raises a big question: Will we ever be able to spot super-realistic fakes? Are we losing the battle against phishing?

This question is causing many companies to re-examine their anti-phishing tactics. To combat phishing attacks head-on, they need to upgrade the main targets of phishing: credentials and outdated MFA. By going passwordless to eliminate dependency on traditional credentials and implementing next-generation MFA. To replace the 20 year old technology of older MFA.

Smart companies are moving from username and password to passwordless authentication. Yet these solutions, even though they represent a great leap forward, also have their limitations. A lost, stolen or compromised device that is not biometric can be used to gain unauthorized access, and mobile phones and other BYOD devices are outside of the organization’s control and are susceptible to all types of malware downloaded by the user.

For these and other reasons, security-first companies are making the decision to move to next-generation multi-factor authentication.

Next generation MFA

Next-generation MFA: Disrupting the surface of phishing attacks

Next-generation MFA replaces traditional credentials, password-based authentication, and cumbersome and vulnerable legacy MFA solutions. The next-generation MFA paradigm is based on a physical, portable FIDO2-compliant device that eliminates the human factor in phishing, making it virtually phishing-proof. These advanced biometric wearables also protect organizations from BYOD vulnerabilities, lost and stolen credentials, weak passwords, credential stuffing, MFA prompt bombing, and easily stolen one-time SMS passcodes. Unlike traditional MFA, attackers simply cannot bypass next-generation MFA with malware, MFA fatigue attacks, Adversary-in-the-Middle (AiTM) attacks, and other methods. Because the authenticator always remains with the user, portable next-gen MFA tokens are continuously secure and immediately available for authentication. Only the authorized user can use the device and no attacker can access the secrets, keys and biometric data stored on it.

GenAI is the driving force behind the coming tsunami of phishing attacks that will effectively nullify traditional phishing defenses and make legacy MFA obsolete. Next generation portable MFA devices such as Token ring stop the most sophisticated phishing attacks and provide the best defense against the coming phishing Armageddon.

Learn more about how Token’s Next-Generation MFA can prevent phishing and ransomware from harming your organization


#Ransomware #Armageddon #coming

Notify of
Inline Feedbacks
View all comments
Previous Post
Twitter Brute-Force Attack

Mandiant’s X account has been hacked with a brute-force attack

Next Post
Atomic Stealer

Atomic Stealer is getting an upgrade

Related Posts