Key members of civil society—including journalists, political activists and human rights advocates—have long been in the cyber crosshairs of well-resourced nation-state threat actors but have scarce resources to protect themselves from cyber threats. On May 14, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released a High-Risk Communities Protection (HRCP) report developed through the Joint Cyber Defense Collaborative that addresses the threat to these vulnerable groups, with findings contributed by the X-Force Threat Intelligence team.

Cyber criminals seek stolen credentials

The HRCP report highlights the significant threat from stolen credentials for these groups—a theme that also plays a key role in the 2024 X-Force Threat Intelligence Index—as the threat from malicious actors stealing and using valid credentials for initial access into networks of interest surged throughout 2023. This threat underscores the necessity of implementing multifactor authentication to protect vulnerable accounts from hacking or takeover.

Credential-based attacks and threats to user identities are far from new, but their effectiveness positions them as a preferred tactic of choice for cyber criminals and state-sponsored actors alike. In fact, in 2020 and 2021, X-Force published details of ITG18 operations (overlaps with Charming Kitten, Phosphorous and TA453) against individuals that leaned on the exploitation of identity. Among other techniques, ITG18 threat actors would validate stolen credentials by copying and pasting stolen victim usernames and passwords into a wide variety of websites, highlighting some of the painstaking techniques used to target members of civil society.

High-risk targets on the hook with a rise in phishing attacks

The HRCP report also urges vigilance against phishing – another common technique used against high-risk members of civil society that X-Force often observes in its incident response engagements.  According to X-Force, phishing played a prominent role in the 2024 X-Force Threat Intelligence Index—tying with the use of stolen credentials as the top technique used by threat actors for initial access.

Most recently, X-Force uncovered  ITG05 (overlaps with APT28, Fancy Bear and Forest Blizzard) operations targeting NGOs through phishing lures, emphasizing that this too is a technique threat actors lean on regularly to advance their objectives. Leveraging robust employee training, phishing security software and multifactor authentication can help to protect organizations from phishing attacks.

Ensure security fundamentals are solid

As governments seek to enhance both their cybersecurity posture and that of key members of civil society, it’s essential not to overlook the criticality of security fundamentals. This includes mitigating the risk of commonly exploited initial access vectors such as valid credential use and phishing. With multiple elections taking place globally in 2024, there is the potential for increased targeting of members of civil society, making it even more imperative to emphasize cybersecurity best practices.

To help governments, critical infrastructure and organizations enhance their cyber preparedness, the X-Force Cyber Range has opened a new location in Washington DC to assist federal government entities and private sector organizations prepare to face a cyber crisis event. Click here to learn more about this capability or to book a tour.

For more information about threat intelligence on the latest tactics, techniques and procedures threat actors are using, schedule a discovery session with the X-Force team.