Cybersecurity professionals are already losing sleep over data breaches and how to best protect their employers from attacks. Now they have another nightmare to stress over — how to spot a deepfake.

Deepfakes are different because attackers can easily use data and images as a weapon. And those using deepfake technology can be someone from inside the organization as well as outside.

How Attackers Use Deepfake Attacks

Earlier in 2021, the FBI released a warning about the rising threat of synthetic content, which includes deepfakes, describing it as “the broad spectrum of generated or manipulated digital content, which includes images, video, audio and text.” People can create the most simple types of synthetic content with software like Photoshop. Deepfake attackers are becoming more sophisticated using technologies like artificial intelligence (AI) and machine learning (ML). Now, these can create realistic images and videos.

Remember, attackers are in the cyber theft business to make money. Ransomware tends to be successful. So, it was a logical move for them to use deepfakes as a new ransomware tool. In the traditional way of sharing ransomware, attackers launch a phishing attack with malware embedded in an enticing deepfake video. There’s also the new way to leverage deepfakes. Attackers can show people or businesses in all sorts of illicit (but fake) behaviors that could damage their reputation if the images went public. Pay the ransom, and the videos stay private.

Besides ransomware, synthetic content is used in other ways. Threat actors might weaponize data and images to spread lies and scam employees, clients and others, or to extort them.

Attackers might use all three of these attack styles together or on their own. Remember, scams have been around for a long time. Phishing attacks are quite ruthless in attempting to scam users already. However, defenders aren’t paying enough attention to the rise of AI/ML to spread misinformation and extortion tactics. Today, attackers can even use apps designed to create pornographic images from real photographs and videos.

Preventing Deepfake Attacks

Users are already duped by phishing attacks, so deepfake phishing attempts will be even more difficult for the average user to detect. Cybersecurity awareness training is a must in any good security program. Make sure it includes how to tell a fake from the real deal.

This is easier than you might expect. The tech behind these attacks is good, but it isn’t perfect. In a webinar, Raymond Lee, CEO of FakeNet.AI and Etay Maor and senior director of security strategy at Cato Networks, explained that facial features are very difficult to perfect, especially the eyes. If the eyes look unnatural or the movement of facial features seem to be off, chances are good that it is an altered image.

Best Practices Apply Here, Too

Another way to detect the deepfake from the real is to use cybersecurity best practices and a zero trust philosophy. Verify whatever you see. Double and triple check the source of the message. Do an image search to find the original, if possible.

When it comes to your own images, use a digital fingerprint or watermark that makes it more difficult for someone to create synthetic content from them.

Overall, the defense systems already in place will work to prevent deepfake phishing and social engineering attacks. Deepfakes are still in the earliest stages as an attack vector, so cybersecurity teams have the advantage of preparing defenses as the tools improve. It really should be one less thing to lose sleep over.

More from Advanced Threats

Black Hat 2022 Sneak Peek: How to Build a Threat Hunting Program

4 min read - You may recall my previous blog post about how our X-Force veteran threat hunter Neil Wyler (a.k.a “Grifter”) discovered nation-state attackers exfiltrating unencrypted, personally identifiable information (PII) from a company’s network, unbeknownst to the security team. The post highlighted why threat hunting should be a baseline activity in any environment. Before you can embark on a threat hunting exercise, however, it’s important to understand how to build, implement and mature a repeatable, internal threat hunting program. What are the components…

4 min read

Top-Ranking Banking Trojan Ramnit Out to Steal Payment Card Data

4 min read - Shopping online is an increasingly popular endeavor, and it has accelerated since the COVID-19 pandemic. Online sales during the 2021 holiday season rose nearly 9% to a record $204.5 billion. Mastercard says that shopping jumped 8.5% this year compared to 2020 and 61.4% compared to pre-pandemic levels. Cyber criminals are not missing this trend. The Ramnit Trojan, in particular, is out for a shopping spree that’s designed to take over people’s online accounts and steal their payment card data. IBM…

4 min read

Detections That Can Help You Identify Ransomware

12 min read - One of the benefits of being part of a global research-driven incident response firm like X-Force Incidence Response (IR) is that the team has the ability to take a step back and analyze incidents, identifying trends and commonalities that span geographies, industries and affiliations. Leveraging that access and knowledge against the ransomware threat has revealed tools, techniques and procedures that can often be detected through the default Windows event logs (WELs). In particular, the X-Force IR team has identified several…

12 min read

How to Report Scam Calls and Phishing Attacks

5 min read - With incidents such as the Colonial Pipeline infection and the Kaseya supply chain attack making so many headlines these days, it can be easy to forget that malicious actors are still preying on individual users. They're not using ransomware to do that so much anymore, though. Not since the rise of big game hunting, anyway. This term marks ransomware actors' shift away from attacks against individual users and towards operations targeting large enterprises, noted CNBC. But attacks like phishing and…

5 min read