CrowdStrike: ‘Cyber attacks by 2024 faster, smarter and more often without malware’

Cybercriminals are adapting their tactics more often. Less use is being made of malware and more of artificial intelligence.

According to the latest CrowdStrike Global Threat Report, 79 percent of cyber attacks were malware-free by 2024, with a rise in AI-driven social engineering and cloud-focused attacks.

Malware obsolete: identity fraud and AI take over

In 2019, 40 percent of cyber attacks already happened without malware. By 2024, that will nearly double to 79 percent. Attackers are increasingly using official system management tools to bypass detection. Networks are also being attacked faster: the average “breakout time,” the time before an attacker penetrates, dropped to 48 minutes and sometimes with outliers of under a minute.

Identity fraud and social engineering are now the most popular methods of attack. ‘Vishing’ (voice phishing) replaced traditional phishing and was used five times more often than the previous year. Cybercriminals impersonate help desk employees to reset passwords or bypass multifactor authentication (MFA). Meanwhile, sales of login credentials rose 50 percent, with massive data breaches on both the dark web and simply accessible forums.

China, AI and cloud intrusions

Cyber activity from China rose 150 percent, with sectors seeing a spike of 200 to 300 percent. These groups are adopting increasingly sophisticated operational security techniques, making them harder to track.

AI is playing an increasing role in cyber attacks. Deepfake scams, automated phishing and AI-generated disinformation campaigns are being used more frequently. For example, a hacker collective from North Korea used AI-powered job interviews to infiltrate tech companies.

Cloud attacks also increased, with accounts being abused in 35 percent of cases. Attackers targeted Microsoft 365, SharePoint and SaaS platforms to steal sensitive data without using malware. Because some attacks can do damage within minutes, CrowdStrike advises companies to deploy phishing-resistant MFA and AI detection. This will best protect login data from malicious actors.

Cybersecurity companies must implement advanced behavioral analytics and cross-domain tracking to detect attackers before they can do damage, according to the report. It is important to recognize the growing risks of poorly optimized cybersecurity and act on them in time.