The Cisco Talos intelligence group over the past year saw an increase in incidents involving insider threats such as malicious insiders and unwitting assets, and is recommending organization's add social engineering to their policies, procedures, and education programs.

The team explained that the current economic climate is one driver of this increased insider threat.

“The economy is on the brink of a recession, inflation continues to spike, and the cryptocurrency markets have lost as much as 70% of their peak value from late 2021. Combined, these factors can create an environment where employees are susceptible to coercion, putting the enterprise at risk,” the group wrote in a blog post. 

The Talos team also found today’s highly polarized political climate presents challenges for employees, especially as we move closer to the 2024 presidential election. It noted employees might react toward an organizations action or inaction relating to political or societal issues.

Another motive might be “taking matters into their own hands” when employees are forced to resign or are fired. “It’s this group that is typically focused on destruction that can really wreak havoc inside an organization,” Talos noted.

These malicious insiders may agree to click phishing links, open attachments, plug in flash drives, or even hand over credentials. “If the malicious insider has an elevated level of access, the effects could be devastating,” the Talos team warns.

Social engineering is becoming a more prominent part of the attack lifecycle, which typically manipulates the user to aid in the intrusion. In this situation, the users become unwitting assets.

As more organizations adopt multi-factor authentication (MFA), attackers also are getting better at bypassing it, commonly through social engineering, according to the Talos team. 

“Through our investigations, we have found numerous examples where attackers pose as IT support or security operations inside an organization and call the victim, using social engineering to get them to accept the MFA request as they are sending it to the device,” they noted. 

In the recently-disclosed attacks targeting Cisco, the bad actor used a similar approach “where voice phishing played a role in the sophisticated attack, illustrating how once attackers have people on the phone, they can more easily manipulate them.”

Additionally, attackers are also starting to explore cryptocurrency and the web3.0 space via social engineering. 

“Users are commonly approached if they post about having issues with their accounts, with criminals waiting to defraud them out of whatever value they have in their wallets,” Talos warns. 

Want to learn more about cloud native and cloud security? Click here to register for SDxCentral’s digital event Security in the Cloud-First Era set for Oct. 11-12. Keynote speakers include representatives from Google Cloud and Verizon Business Services. Register today.