The 2023 Threat Landscape From ENISA Highlights the Risk of AI-Enabled Information Manipulation

The European Union Agency for Cybersecurity, or ENISA, recently released its 2023 Threat Landscape report, underscoring the imperative need for heightened vigilance, particularly in anticipation of the upcoming European elections in 2024. In the period of analysis spanning from July 2022 to June 2023, ENISA meticulously recorded an approximate total of 2,580 incidents, coupled with an additional 220 incidents precisely aimed at impacting two or more EU Member States. This unequivocally serves as a resounding testament to the enduring vulnerabilities inherent in our contemporary digital era.

Cyber Threats and Vulnerabilities Across the EU

The enormity of the threat of cyberattacks has been well felt throughout the digital community. According to the report, sectors bearing the brunt of these cyber threats include public administration (18%) and the health sector (8%). Yet the intricate web of interdependencies within our digital ecosystem often resulted in cascading effects, where a single incident would reverberate across multiple sectors simultaneously. 

#ENISA published recently a new #booklet 📒 titled "Foresight 2030 Threats". This booklet summarises upcoming #challenges and provides for an assessment of the #risks ⚠️
ℹ️ Check it out here ➡️ https://t.co/LAnJNTgAif#CyberSecurity #threats https://t.co/UFslFGQU3g

— K3Y (@K3Y_BG) October 23, 2023

The report also delves into the impact of social engineering and information manipulation campaigns, revealing that 30% of such events targeted the general public, 18% targeted public administration, and 8% spanned across all sectors. 

Information manipulation campaigns posed a considerable threat to the integrity of election processes, targeting individuals (47%), public administration (29%), defence (9%), and media and entertainment (8%). Additionally, the report highlights the focus on Remote Monitoring and Management (RMM) software as a way for cybercriminals to blend in with regular operations. 

Insights from EU Agency Executive Director

Juhan Lepassaar, the Executive Director of the EU Agency for Cybersecurity, has astutely highlighted the critical importance of secure cyber infrastructures and the integrity of information. Trust in the electoral process rests heavily on our capacity to ensure cyber-secure environments. It is thus imperative that we collectively undertake the necessary measures to secure this essential foundation of our democracies. 

The Ever-Evolving Threat Landscape and Adapting Threat Actors

The threat landscape is ever-evolving, with cybercriminals, state-nexus actors, and hacktivists dynamically responding to geopolitical events. State-nexus actors have increasingly set their sights on employees in crucial roles, including politicians, government officials, journalists, and activists. Their tactics range from traditional spear-phishing emails to leveraging social networks for nefarious purposes. 

Interestingly, these actors have started adopting attack patterns reminiscent of criminal campaigns, with instances of direct or indirect support for cybercriminals. Techniques such as targeted malvertising, where malicious sites point to trojan versions of legitimate applications, and gaining control over the operating system’s booting process to disable security mechanisms have been observed. 

Furthermore, threat actors exploit configuration errors in security products, either to disable antivirus without administrator privileges or for lateral movement within systems. The cloud has not remained immune, with cybercriminals leveraging cloud infrastructure to cause harm by abusing misconfigurations. This extends beyond an organisation’s systems and networks to the management consoles of cloud infrastructures. 

Prime Threats: Ransomware and DDoS Attacks

The preeminent perils shown within the report encompass ransomware, which comprises a substantial 34% share of all threats within the European Union (EU), and Distributed Denial of Service (DDoS) assaults, representing a notable 28% portion of the overall threat milieu. The encroachment of ransomware extends across various sectors, with manufacturing attributing 14% of ransomware incidents, health accounting for 13%, public administration accounting for 11%, and services comprising 9% of the reported cases.

When it comes to DDoS attacks and data-related threats, public administration takes the lead, which was targeted in 34% of DDoS attacks. This was followed by the transport sector (17%) and the banking and finance sectors (9%). The availability of internet resources has been affected, primarily impacting digital infrastructure (28%) and digital service providers (10%). 

Supply chain attacks have also raised substantial concerns, particularly concerning the upcoming elections. These attacks have impacted public administration (21%) and digital service providers (16%). Exploitation of vulnerabilities also played a role, with digital service providers (25%), digital infrastructures (23%), and public administration (15%) being affected. 

Motivations Behind Cyber Threats

The primary motivation behind these threats often combines intentions such as financial gain, disruption, espionage, destruction, or ideological motivations in the case of hacktivism. While ransomware attacks are typically motivated by financial gain, some also aim to disrupt operations, making disruption the second most common motive. DDoS attacks and information manipulation campaigns are primarily driven by disruption, emphasising the critical role they play today. 

Also Read: X’s Struggle in Tackling Misinformation Amid Israel Conflict

The Role of AI and the Resurgence of Older Techniques

When it comes to Artificial Intelligence (AI), the report draws attention to the increasing complexity of Large Language Models (LLMs) and the potential misuse of deepfake technology and AI-powered chatbots in phishing attempts, information manipulation, and cybercrime. It’s noteworthy that older techniques like search engine optimisation (SEO) poisoning and malvertising have made a resurgence, drawing fresh interest from cybercriminal actors. 

Increasing CVEs: The Imperative of Proactive Cybersecurity

Finally, the report highlights a significant increase in the number of Common Vulnerabilities and Exposures (CVEs) recorded, marking a 2,770 increase compared to the prior reporting period. In total, 24690 CVEs were identified, reflecting the ever-present and evolving nature of vulnerabilities in the digital landscape. This underscores the need for proactive cybersecurity measures and vigilance to protect critical systems and information. 

The Importance of Proactive Cybersecurity

In light of the 2023 Threat Landscape report from ENISA, it is abundantly clear that the digital realm continues to be a hotbed of cyber threats and vulnerabilities. The growing risk of AI-enabled information manipulation looms large, emphasising the need for unwavering vigilance and stringent security measures, especially with the upcoming European elections on the horizon. 

The report is a resounding reminder that underscores the persistent vulnerabilities inherent in our increasingly interconnected digital age. The report paints a vivid picture of the evolving digital threat landscape, demanding not only heightened vigilance but also strategic action to protect our democratic processes and critical infrastructure. 

Also Read: Top 5 Cybersecurity Solutions Today