Deepfakes are synthetic video or audio files generated using deep learning algorithms. Most people recognize the rather harmless use of deepfakes to create amusing videos, often by replacing one person’s face with another in an existing clip. There are far more nefarious uses of this technology, though.  

One likely possibility in 2022 is the emergence of deep phishing. Threat actors will create audio or video impersonating a CEO, owner, or other high-level company employee to get people to disclose confidential information or take another desired action that could lead to extortion, account takeover, or data breach.  

The likelihood of being duped by a voicemail message that sounds exactly like a company leader is very high. The same rings true for videos. Since CEOs and owners often have a strong public presence, threat actors have a lot of training data to work with. Webinar video appearances, podcasts, and other media can be used as inputs to help the deep learning algorithm more accurately generate videos or audio impersonating someone.

Supply Chain Phishing 

Several recent cyber attacks highlight how adversaries seek to exploit weak links in supply chains to compromise lucrative targets. Phishing campaigns will increasingly target third-parties including partners, vendors, and suppliers in 2022. By taking over an account at one of these supply chain weak points, threat actors can then start to leverage the trusted relationships with these third parties to send malicious emails to other target-rich organizations.

The partner or supplier’s domain will often be trusted by default at the target company, which makes it much harder for a secure email gateway to flag or detect a spoofed email address or phishing emails. Supply chain phishing is a possibility even without third party account compromise. Merely spoofing a partner may be enough to fool someone and get network access or additional intel like a bank account number or other personal information that can be used in a spear phishing attack.

Ransomware Gangs Evolving 

The link between phishing and ransomware is so strong that it’s important to try and predict how these attacks will unfold over the coming months. The emergence of BlackCat in late 2021 served as the first warning sign of what to expect.

Ransomware has always preyed on extortion—in its earliest form, ransomware extortion tactics focused on using the fear of encrypted servers, files, and workstations to get victims to pay up. Double extortion added the threat of data exfiltration to the mix over the last 24 months. 

In 2022, expect ransomware gangs to add another layer to their extortion tactics. To further pressure victims to make payments, triple extortion adds the threat of a DDoS attack on victims’ network infrastructures. In a world where downtime is incredibly costly, many organizations will ponder paying up to avoid this outcome.  

Another evolution to expect is ransomware hackers increasingly shifting towards other cryptocurrencies to receive ransom payments. Bitcoin is not untraceable, and law enforcement employs various analytical techniques to map Bitcoin addresses to IP addresses. Considering the mainstream nature of Bitcoin and its privacy vulnerabilities, expect to see more ransomware actors demanding payments via coins with strong privacy features, such as Monero and Zcash.  

More to Come… 

That wraps up the first part of this two-part series on email and phishing predictions for 2022. If there’s one takeaway here, it’s that phishing will evolve to become an even more sophisticated threat this year. Relying on security-aware employees alone won’t be enough. Businesses will need an advanced email security solution as part of their security strategy to help combat modern phishing threats.