An attacker attempts to breach an executive's personal laptop, but effective multifactor authentication (MFA) blocks them. Actually, it was only a deterrent, because the attacker discovers the executive's son did not enable MFA on his gaming console, and uses that access to move laterally, eventually breaking into the corporate network.
Cybercriminals' increasingly brazen techniques have expanded beyond the office walls to target top executives' family members and friends who may not know how to protect themselves— worse yet, they don't even see it coming. While leadership receives ongoing security awareness training on password hygiene, and how to look out for signs of phishing and vishing, that still leaves those closest to them vulnerable, creating a dangerous blind spot for organizations, and artificial intelligence (AI) now offers bad actors new tools to exploit it.
In March, Google Cloud's Office of the CISO warned that personal attacks against executives are on the rise. Authors urged boards to consider how they are supporting executives and their families in implementing effective social media settings, knowing attackers routinely use that avenue for reconnaissance.
Attacks abusing those relationships always start with reconnaissance, due to everyone's enormous digital footprint. Eerily, an attacker can map out a household's relationships, routines, and locations without ever touching a network, warns Brian Hill, field chief information security officer (CISO) of client advisory at BlackCloak.
From there, attacks branch out into three categories: impersonation, compromising the household's devices, and phishing or smishing—a tactic aimed at less technical family members.
However, the consequences aren't just digital, Hill warns. A leaked itinerary or home address can turn into physical surveillance, a break-in, or extortion.
"Even something as harmless as a child's school play on a shared calendar can give an attacker exactly the timing they need for a fraudulent wire request," Hill tells Dark Reading.