In the first half of 2020 we saw skyrocketing ransomware, spear phishing, and IoT and mobile malware attacks linked to a new, deadly virus that killed more than 700,000 people and shut down most of the globe. So what does McAfee’s Head of Advanced Threat Research Steve Povolny expect to see during the rest of the year?

“Zombies. You know, other forms of Apocalypse.”

He’s joking — sort of. But even if we can rule out zombies, from a cyberthreat perspective the remainder of 2020 looks scary.

“I think we’re going to continue to see these more advanced and evolution of [attack] techniques,” Povolny said, during an interview at this week’s virtual Black Hat. “We’re going to see the consistent use of ransomware, we’re going to see the same breaches we’ve been seeing forever. After 20 years, if it’s not changing, it’s not going anywhere for the foreseeable future.”

But in addition to attackers targeting traditional vulnerabilities like unpatched software and default passwords, Povolny also expects emerging attack vectors to come into play. The security vendor detailed a handful of these in its 2020 threat predictions report published last December. Some — like ransomware attacks morphing into two-stage extortion campaigns — already came to fruition.

Other threats McAfee forecast, like using deep fakes to bypass facial recognition, are on the horizon. “We’re looking into deep fakes and how they can be used,” Povolny said. “We’re gonna see a lot more focus on election hacking and campaigns targeting the election. So I think that we’ll see a combination of traditional threats, but also bringing in some of the new kind of AI- and machine learning-focused threats that we’ll start to see more prevalently.”

At Black Hat this week, McAfee announced product updates. It integrated MITRE ATT&CK, a global database of attack techniques, into McAfee Mvision Cloud, which is the vendor’s cloud access security broker (CASB). This gives enterprises a more precise method to hunt and stop cyberattacks on cloud services.

Also at Black Hat, McAfee published threat research about emerging artificial intelligence (AI) and machine learning threats. This includes flaws in temi personal robots, which are used in hospitals, hotels, and retail stores, that allow an attacker to navigate it around, and activate the camera and microphone. And all the attacker would need to know to hack temi is the victim’s phone number.

Another paper details how relatively easy it is to trick facial recognition systems like passport scanners into identifying a computer-generated image of a real person — a deep fake — as the actual human. In addition to having frightening real-world implications for the travel industry, like allowing a terrorist to board a plane using a fake passport, this also illustrates the danger of false positives in facial recognition used for law enforcement.

“This kind of automation and enforcement of facial recognition extends far beyond just passport control,” Povolny said. “It speaks to crowd control and criminal recognition and all sorts of law enforcement and privacy questions where really, we haven’t even scratched the surface.”

Citing these concerns, Amazon, Microsoft, and IBM all recently said they would either cut their facial recognition businesses all together or stop selling their technology to police.

"The issues surrounding this are just monumental,” Povolny said.