World Social Media Day: How Threat Actors are Weaponizing Social Media, from Phishing to AI-Powered Deepfakes

The Philippines is one of the most active social media communities worldwide, according to the Digital 2023 report. With 72.5% of the population on social media, Filipinos spend an average of 3 hours and 43 minutes on these channels to keep in touch with family and friends, read news stories, and find content.  As social media continues to exert its influence on everyday lives, it becomes increasingly crucial for Filipinos to remain vigilant regarding the evolving dangers associated with its usage. Recent technological advancements, particularly in the realm of artificial intelligence, have further exacerbated these risks, necessitating heightened awareness and precautionary measures.

With World Social Media Day around the corner, here are three ways social media is putting individuals and organizations at risk.

Social media preys on psychological weakness
Hackers consistently rely on user behavior to provide the openings they need to penetrate network defenses. While some look to exploit unpatched vulnerabilities in a system or network, often the most efficient way to target a business is through social engineering methods that manipulate users into breaching security policies and giving away information that can be used to steal data or launch an attack. 

According to Palo Alto Networks Unit 42’s 2022 Incident Response Report, attackers used phishing, a form of social engineering, 40% of the time to gain initial access to a system. By studying an employee’s social media profile, cybercriminals are able to develop a comprehensive profile of their victim, which they can then use to launch a targeted attack. These attacks appeal to emotions such as fear, curiosity, urgency, and greed and beckon unsuspecting employees to click on a link or attachment, ignoring basic cybersecurity hygiene. And with the Unit 42 Network Threat Trends Research Report finding that 66% of malware is delivered through PDFs, just one erroneous click of the button can lead to disastrous consequences, enabling malicious macros to infiltrate the system.

From catfishing to AI-cultivated deepfakes

Another risk associated with social media is that it involves people establishing connections without necessarily needing to establish authenticity. This requires a leap of faith, which can easily be exploited by threat actors. From identity theft to catfishing, cybercriminals use social media to capture information and content from unsuspecting victims, assume their identities, and commit fraudulent activity. 

But the breadth of ways impersonations or fake identities are being used in the security space is growing. As technological advancements improve the quality, customisability, and accessibility of artificial intelligence-enabled content creation, malicious actors are using this technology to exploit images and videos—often taken from social media platforms—and manipulate them into content that can be used for extortion, harassment, misinformation, and reputational damage. 

When disseminated through social media, convincing fake content—deepfakes—can instantly reach millions. A video altered to make it appear as if a CEO was announcing that profits were down could impact a company’s stock price; similarly, a presidential candidate appearing to confess complicity in a crime could lead to the disruption of an election. Although impersonators don’t necessarily need to be using techniques as advanced as deepfakes to cause havoc, such as the case of a fake account for a US pharma company announced it would be distributing free insulin, causing the company’s stock to plummet.

Malware and ransomware infiltrate the social web

Alongside using social media for intelligence gathering and dissemination, cybercriminals also share malicious links on social media directly. These links, harboring anything from viruses, trojans, spyware, and ransomware, help hackers access devices and networks to steal data and take control of systems. 

Of these formats, ransomware is seeing alarming growth. Philippine organizations were found by Unit 42’s Ransomware and Extortion Report to be severely affected by ransomware, with attacks surging to around 60% in 2022.

As public interest in generative AI grows, malicious actors also use this to their advantage, with ChatGPT-themed lures increasingly being used to spread malware across platforms like Facebook, Instagram, and WhatsApp. Earlier this year, Meta’s security teams uncovered 10 malware families using ChatGPT (and similar themes) to deliver malicious software to users’ devices. In one instance, cybercriminals created malicious browser extensions available in official web stores that claim to offer ChatGPT-based tools, which were then promoted on social media and through sponsored search results to trick people into downloading malware. 

Tackling social media-powered cybercrime 

The above are just a few tools among a wide-ranging toolkit that cybercriminals are using to weaponize social media. And with the number of social media users worldwide predicted to grow to close to 6 billion by 2027, the risk that these platforms pose is unlikely to go away.

So what can organizations do to protect their employees? First and foremost, embedding cybersecurity education within the workplace curriculum and regularly testing the effectiveness of that training is crucial. Many companies incorporate measures like rewarding employees that spot phishing attempts and report them to the security operations team, and they see the value these practices can have for promoting cybersafety. 

On a company level, organizations should prioritize embedding a safety-first culture with a plan in place to manage the inevitability of a cyber incident. Business leaders should constantly be identifying, measuring, and evaluating risks and, where possible, limit access to sensitive information to need-to-know employees. Alongside building a robust defense plan, organizations should also establish a social media policy that sets standards around the organization’s online interactions, imposes consequences for misuse of social media, and mandates cyber awareness training for those directly involved with content publishing. 

Sean Duca, Vice President and Regional Chief Security Officer, Japan & Asia Pacific, said, “Ultimately, everyone has the right to feel safe online. And with the threat of a cyberattack ever-present in our personal and professional spaces, education is key to ensuring our digital identities and our business assets remain protected.”

###

About Palo Alto Networks

Palo Alto Networks is the world’s cybersecurity leader. We innovate to outpace cyber threats, so organisations can embrace technology with confidence. We provide next-gen cybersecurity to thousands of customers globally, across all sectors. Our best-in-class cybersecurity platforms and services are backed by industry-leading threat intelligence and strengthened by state-of-the-art automation. Whether deploying our products to enable the Zero Trust Enterprise, responding to a security incident, or partnering to deliver better security outcomes through a world-class partner ecosystem, we’re committed to helping ensure each day is safer than the one before. It’s what makes us the cybersecurity partner of choice.

At Palo Alto Networks, we’re committed to bringing together the very best people in service of our mission, so we’re also proud to be the cybersecurity workplace of choice, recognized among Newsweek’s Most Loved Workplaces (2021), Comparably Best Companies for Diversity (2021), and HRC Best Places for LGBTQ Equality (2022). For more information, visit www.paloaltonetworks.com.

Palo Alto Networks, Cortex, Unit 42, and the Palo Alto Networks logo are registered trademarks of Palo Alto Networks, Inc. in the United States and in jurisdictions throughout the world. All other trademarks, trade names, or service marks used or mentioned herein belong to their respective owners. Any unreleased services or features (and any services or features not generally available to customers) referenced in this or other press releases or public statements are not currently available (or are not yet generally available to customers) and may not be delivered when expected or at all. Customers who purchase Palo Alto Networks applications should make their purchase decisions based on services and features currently generally available.

ChatGPT: Can it help AI-led Cyberattacks?

MANILA, PHILIPPINES—Science, technology and all its components have strongly benefited the human race over generations. By definition, it is the search for new knowledge to improve the quality of life.  However, everything has the potential of being good or bad depending on the people who are behind it.

The relentless quest to mimic and decipher the human mind has ushered an era of Artificial Intelligence. ChatGPT, a text-based artificial intelligence (AI) bot has made headlines for its use of advanced AI. From accurately fixing a coding bug, generating cooking recipes, creating 3D animations, to composing entire songs, ChatGPT has showcased the mindblowing power of AI to unlock a world of incredible new possibilities and new risks.

Since its launch on November 2022, tech experts and commentators worldwide have been concerned about the impact AI-generated content tools will have on cybersecurity. 

In the recent Black Hat and Defcon security conferences, a demonstration of hacking humans with AI-as-a-service revealed howAI can actually craft better phishing emails and devilishly effective spear phishing messages than people.

Researchers using OpenAI's GPT-3 platform in combination with other AI-as-a-service products focused on personality analysis generated phishing emails that were generated customised using their colleagues' backgrounds and characters. Eventually, the researchers developed a pipeline that refined the emails before hitting their targets. To their surprise, the platform also automatically supplied specifics, such as mentioning a Singaporean law when instructed to generate content for people in Singapore.

The makers of ChatGPT have clearly suggested that the AI-driven tool has the in-built ability to challenge incorrect premises and reject inappropriate requests. While the system apparently has inbuilt guardrails designed to prevent any kind of criminal activities, however, with a few tweaks, it generated a near flawless phishing email that sounded ‘Weirdly Human’. 

This could mean more trouble for markets that are highly vulnerable to phishing attacks such as the Philippines. In fact, the enormity of phishing campaigns in the country prompted the government to begin investigations. This resulted in the approval of the SIM Card Registration Act, a law that mandates users to register personal information upon SIM card activation and purchase in an effort to encourage responsibility and give law enforcement an identification tool for resolving crimes.

Sean Duca, Vice President and Regional Chief Security Officer for Asia Pacific & Japan at Palo Alto Networks, said, “Considering the looming threats of an ever smarter and technologically advanced hacking landscape, the cybersecurity industry must be equally resourced to fight such AI-powered exploits. In the long run, the industry’s vision cannot be that a swarm of human threat hunters try to sporadically fix this with guesswork.” 

The need of the hour is to take intelligent action to neutralise these evolving threats. On the positive side, Autonomous Response is today significantly addressing threats without human intervention. However, as AI-powered attacks become a part of everyday life, businesses, governments and individuals impacted by such automated malware must increasingly rely on emerging technologies such as AI and ML to generate their own automated responses.

As AI continues to be developed, businesses will continue to face a number of challenges in navigating the AI cybersecurity landscape. In particular, there is considerable focus on finding the balance between machines, humans, and ethical considerations. 

“Establishing corporate policies is critical to doing business ethically, while improving cybersecurity. We need to establish effective governance and legal frameworks that enable greater trust in AI technologies being implemented around us to be safe, reliable, and contribute to a just and sustainable world. The delicate balance between AI and humans will therefore emerge as a key factor towards successful cybersecurity in which trust, transparency, and accountability supplement the benefits of machines,” Duca concluded.

###

About Palo Alto Networks

Palo Alto Networks is the world’s cybersecurity leader. We innovate to outpace cyberthreats, so organizations can embrace technology with confidence. We provide next-gen cybersecurity to thousands of customers globally, across all sectors. Our best-in-class cybersecurity platforms and services are backed by industry-leading threat intelligence and strengthened by state-of-the-art automation. Whether deploying our products to enable the Zero Trust Enterprise, responding to a security incident, or partnering to deliver better security outcomes through a world-class partner ecosystem, we’re committed to helping ensure each day is safer than the one before. It’s what makes us the cybersecurity partner of choice.

At Palo Alto Networks, we’re committed to bringing together the very best people in service of our mission, so we’re also proud to be the cybersecurity workplace of choice, recognized among Newsweek’s Most Loved Workplaces (2021), Comparably Best Companies for Diversity (2021) and HRC Best Places for LGBTQ Equality (2022). For more information, visit www.paloaltonetworks.com.

Palo Alto Networks Unit 42 Incident Response Report Reveals that Phishing and Software Vulnerabilities Cause Nearly 70% of Cyber Incidents

MANILA, 15 August 2022 — According to a new report from Palo Alto Networks (NASDAQ: PANW), the global cybersecurity leader, the heavy use of software vulnerabilities matches the opportunistic behavior of threat actors who scour the internet for vulnerabilities and weak points on which to focus. The 2022 Unit 42 Incident Response Report offers a multitude of insights gleaned from Unit 42 by Palo Alto Networks' extensive incident response (IR) work, leveraging a sampling of over 600 Unit 42 IR cases, to help chief information security officers (CISOs) and security teams understand the greatest security risks they face, and where to prioritize resources to reduce them.

Oscar Visaya, Country Manager for the Philippines at Palo Alto Networks, shared, “As cybercriminals find more ways to exploit these software vulnerabilities, organizations must take the necessary steps to minimize the risks for the company and its stakeholders. Organizations must ramp up patch management and orchestration to try to close these known holes as soon as possible.”

Ransomware and business email compromise (BEC) were the top incident types that the Incident Response team responded to over the past 12 months, accounting for approximately 70% of incident response cases. The findings reflect local data of research company Statista in which phishing emerged as the most frequent fraud scheme targeting consumers in the Philippines in Q1 2022. 

• Ransomware

A new ransomware victim is posted on leak sites every four hours. Identifying ransomware activity early is critical for organizations. Typically, ransomware actors are only discovered after files are encrypted, and the victim organization receives a ransom note. Unit 42 has identified that the median dwell time — meaning the time threat actors spend in a targeted environment before being detected — observed for ransomware attacks was 28 days. Ransom demands have been as high as $30 million, and actual payouts have been as high as $8 million, a steady increase compared to the findings of the 2022 Unit 42 Ransomware Report. Increasingly, affected organizations can also expect threat actors to use double extortion, threatening to publicly release sensitive information if a ransom isn’t paid. In the same report, the Philippines was also discovered as a key target for BlackCat Ransomware which emerged in late 2021. 

• BEC

Cybercriminals used a variety of techniques in business email compromise wire-fraud schemes. Forms of social engineering, such as phishing, offer an easy and cost-effective way to gain covert access while maintaining a low risk of discovery. According to the report, in many cases, cybercriminals are simply asking their unwitting targets to hand over their credentials — and getting them. Once they have access, the median dwell time for BEC attacks was 38 days, and the average amount stolen was $286,000.

“Right now, cybercrime is an easy business to get into because of its low cost and often high returns. As such, unskilled, novice threat actors can get started with access to tools like hacking-as-a-service becoming more popular and available on the dark web,” said Wendi Whitmore, SVP and head of Unit 42 at Palo Alto Networks. “Ransomware attackers are also becoming more organized with their customer service and satisfaction surveys as they engage with cybercriminals and the victimized organizations”

Palo Alto Networks customers can take advantage of Cortex Xpanse for attack surface management to identify vulnerable internet-exposed systems and can often catch systems that organizations may not be aware are running on the network. Customers also receive protections against the specific vulnerabilities discussed in this post through Cortex XDR, Prisma Cloud, Cloud-Delivered Security Services, and other products.

###

Unit 42 Incident Response Services 

Palo Alto Networks Unit 42 has an experienced team of security consultants with backgrounds in public and private sectors who have handled some of the largest cyberattacks in history. They manage complex cyber risks and respond to advanced threats, including nation-state attacks, advanced persistent threats, or APTs, and complex ransomware investigations. Unit 42 incident response experts are available 24/7 to help clients understand the nature of the attack and then quickly contain, remediate and eradicate it. They utilize a proven methodology and battle-tested tools developed from real-world experiences investigating thousands of incidents.

Further detail on future predictions, tips to stay safe, additional data points and more can be found in the “2022 Unit 42 Incident Response Report,” which can be downloaded on the Palo Alto Networks website. A summary of the report is available on the Unit 42 blog. 

About Unit 42

Palo Alto Networks Unit 42 brings together world-renowned threat researchers, elite incident responders and expert security consultants to create an intelligence-driven, response-ready organization that’s passionate about helping you proactively manage cyber risk. Together, our team serves as your trusted advisor to help assess and test your security controls against the right threats, transform your security strategy with a threat-informed approach and respond to incidents in record time so that you get back to business faster. Visit paloaltonetworks.com/unit42. 

About Palo Alto Networks

Palo Alto Networks is the world’s cybersecurity leader. We innovate to outpace cyberthreats, so organizations can embrace technology with confidence. We provide next-gen cybersecurity to thousands of customers globally, across all sectors. Our best-in-class cybersecurity platforms and services are backed by industry-leading threat intelligence and strengthened by state-of-the-art automation. Whether deploying our products to enable the Zero Trust Enterprise, responding to a security incident, or partnering to deliver better security outcomes through a world-class partner ecosystem, we’re committed to helping ensure each day is safer than the one before. It’s what makes us the cybersecurity partner of choice.

 

At Palo Alto Networks, we’re committed to bringing together the very best people in service of our mission, so we’re also proud to be the cybersecurity workplace of choice, recognized among Newsweek’s Most Loved Workplaces (2021), Comparably Best Companies for Diversity (2021), and HRC Best Places for LGBTQ Equality (2022). For more information, visit www.paloaltonetworks.com. 

Palo Alto Networks and the Palo Alto Networks logo are trademarks of Palo Alto Networks, Inc. in the United States and in jurisdictions throughout the world. All other trademarks, trade names, or service marks used or mentioned herein belong to their respective owners. Any unreleased services or features (and any services or features not generally available to customers) referenced in this or other press releases or public statements are not currently available (or are not yet generally available to customers) and may not be delivered when expected or at all. Customers who purchase Palo Alto Networks applications should make their purchase decisions based on services and features currently generally available.