Key members of civil society—including journalists, political activists and human rights advocates—have long been in the cyber crosshairs of well-resourced nation-state threat actors but have scarce resources to protect themselves from cyber threats. On May 14, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released a High-Risk Communities Protection (HRCP) report developed through the Joint Cyber Defense Collaborative that addresses the threat to these vulnerable groups, with findings contributed by the X-Force Threat Intelligence team.

Cyber criminals seek stolen credentials

The HRCP report highlights the significant threat from stolen credentials for these groups—a theme that also plays a key role in the 2024 X-Force Threat Intelligence Index—as the threat from malicious actors stealing and using valid credentials for initial access into networks of interest surged throughout 2023. This threat underscores the necessity of implementing multifactor authentication to protect vulnerable accounts from hacking or takeover.

Credential-based attacks and threats to user identities are far from new, but their effectiveness positions them as a preferred tactic of choice for cyber criminals and state-sponsored actors alike. In fact, in 2020 and 2021, X-Force published details of ITG18 operations (overlaps with Charming Kitten, Phosphorous and TA453) against individuals that leaned on the exploitation of identity. Among other techniques, ITG18 threat actors would validate stolen credentials by copying and pasting stolen victim usernames and passwords into a wide variety of websites, highlighting some of the painstaking techniques used to target members of civil society.

Download the report

High-risk targets on the hook with a rise in phishing attacks

The HRCP report also urges vigilance against phishing – another common technique used against high-risk members of civil society that X-Force often observes in its incident response engagements.  According to X-Force, phishing played a prominent role in the 2024 X-Force Threat Intelligence Index—tying with the use of stolen credentials as the top technique used by threat actors for initial access.

Most recently, X-Force uncovered  ITG05 (overlaps with APT28, Fancy Bear and Forest Blizzard) operations targeting NGOs through phishing lures, emphasizing that this too is a technique threat actors lean on regularly to advance their objectives. Leveraging robust employee training, phishing security software and multifactor authentication can help to protect organizations from phishing attacks.

Ensure security fundamentals are solid

As governments seek to enhance both their cybersecurity posture and that of key members of civil society, it’s essential not to overlook the criticality of security fundamentals. This includes mitigating the risk of commonly exploited initial access vectors such as valid credential use and phishing. With multiple elections taking place globally in 2024, there is the potential for increased targeting of members of civil society, making it even more imperative to emphasize cybersecurity best practices.

To help governments, critical infrastructure and organizations enhance their cyber preparedness, the X-Force Cyber Range has opened a new location in Washington DC to assist federal government entities and private sector organizations prepare to face a cyber crisis event. Click here to learn more about this capability or to book a tour.

For more information about threat intelligence on the latest tactics, techniques and procedures threat actors are using, schedule a discovery session with the X-Force team.

More from X-Force

Q&A with Valentina Palmiotti, aka chompie

4 min read - The Pwn2Own computer hacking contest has been around since 2007, and during that time, there has never been a female to score a full win — until now.This milestone was reached at Pwn2Own 2024 in Vancouver, where two women, Valentina Palmiotti and Emma Kirkpatrick, each secured full wins by exploiting kernel vulnerabilities in Microsoft Windows 11. Prior to this year, only Amy Burnett and Alisa Esage had competed in the contest's 17-year history, with Esage achieving a partial win in…

X-Force discovers new vulnerabilities in smart treadmill

7 min read - This research was made possible thanks to contributions from Joshua Merrill. Smart gym equipment is seeing rapid growth in the fitness industry, enabling users to follow customized workouts, stream entertainment on the built-in display, and conveniently track their progress. With the multitude of features available on these internet-connected machines, a group of researchers at IBM X-Force Red considered whether user data was secure and, more importantly, whether there was any risk to the physical safety of users. One of the most…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today