Key members of civil society—including journalists, political activists and human rights advocates—have long been in the cyber crosshairs of well-resourced nation-state threat actors but have scarce resources to protect themselves from cyber threats. On May 14, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released a High-Risk Communities Protection (HRCP) report developed through the Joint Cyber Defense Collaborative that addresses the threat to these vulnerable groups, with findings contributed by the X-Force Threat Intelligence team.

Cyber criminals seek stolen credentials

The HRCP report highlights the significant threat from stolen credentials for these groups—a theme that also plays a key role in the 2024 X-Force Threat Intelligence Index—as the threat from malicious actors stealing and using valid credentials for initial access into networks of interest surged throughout 2023. This threat underscores the necessity of implementing multifactor authentication to protect vulnerable accounts from hacking or takeover.

Credential-based attacks and threats to user identities are far from new, but their effectiveness positions them as a preferred tactic of choice for cyber criminals and state-sponsored actors alike. In fact, in 2020 and 2021, X-Force published details of ITG18 operations (overlaps with Charming Kitten, Phosphorous and TA453) against individuals that leaned on the exploitation of identity. Among other techniques, ITG18 threat actors would validate stolen credentials by copying and pasting stolen victim usernames and passwords into a wide variety of websites, highlighting some of the painstaking techniques used to target members of civil society.

Download the report

High-risk targets on the hook with a rise in phishing attacks

The HRCP report also urges vigilance against phishing – another common technique used against high-risk members of civil society that X-Force often observes in its incident response engagements.  According to X-Force, phishing played a prominent role in the 2024 X-Force Threat Intelligence Index—tying with the use of stolen credentials as the top technique used by threat actors for initial access.

Most recently, X-Force uncovered  ITG05 (overlaps with APT28, Fancy Bear and Forest Blizzard) operations targeting NGOs through phishing lures, emphasizing that this too is a technique threat actors lean on regularly to advance their objectives. Leveraging robust employee training, phishing security software and multifactor authentication can help to protect organizations from phishing attacks.

Ensure security fundamentals are solid

As governments seek to enhance both their cybersecurity posture and that of key members of civil society, it’s essential not to overlook the criticality of security fundamentals. This includes mitigating the risk of commonly exploited initial access vectors such as valid credential use and phishing. With multiple elections taking place globally in 2024, there is the potential for increased targeting of members of civil society, making it even more imperative to emphasize cybersecurity best practices.

To help governments, critical infrastructure and organizations enhance their cyber preparedness, the X-Force Cyber Range has opened a new location in Washington DC to assist federal government entities and private sector organizations prepare to face a cyber crisis event. Click here to learn more about this capability or to book a tour.

For more information about threat intelligence on the latest tactics, techniques and procedures threat actors are using, schedule a discovery session with the X-Force team.

More from X-Force

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns

16 min read - Since March 2024, IBM X-Force has been tracking several large-scale phishing campaigns distributing the Grandoreiro banking trojan, which is likely operated as a Malware-as-a-Service (MaaS). Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails. The latest malware variant also specifically targets over 1500 global banks, enabling attackers to perform banking fraud in over 60 countries…

Evolving red teaming for AI environments

2 min read - As AI becomes more ingrained in businesses and daily life, the importance of security grows more paramount. In fact, according to the IBM Institute for Business Value, 96% of executives say adopting generative AI (GenAI) makes a security breach likely in their organization in the next three years. Whether it’s a model performing unintended actions, generating misleading or harmful responses or revealing sensitive information, in the AI era security can no longer be an afterthought to innovation.AI red teaming is emerging…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today