SANS Reveals Top 5 Most Dangerous Cyberattacks for 2023

SEO-aided attacks, developer targeting, and malicious use of AI top the list for 2023.

RSA CONFERENCE 2023 - San Francisco — Expert instructors from the SANS Institute here yesterday detailed what they cite as the most dangerous forms of cyberattacks for 2023.
Some of the key themes bubbling to the surface included the intersection of AI with attack patterns and the ways that attackers are taking advantage of highly flexible development environments.
This is my favorite panel of the year, said Ed Skoudis, president of
SANS Technology Institute College
and moderator of the panel, who introduced SANS panelists as both teachers for his organizations as well as expert practitioners with real-world experience about whats currently going down in the attack landscape.
These are the folks that I turn to and a whole lot of other folks turn to get the latest on what the attacks are all about and what we need to do to defend against them, he said.
Just as regular businesses utilize search engine optimization (SEO) to boost the rankings of certain terms for the sake of marketing their products and driving traffic to revenue-generating sites, the
bad guys also turn to SEO
. In their case they use it to boost the rankings of their malware-laden sites in order to send more victims their way, explained Katie Nickels, senior director of digital intelligence for Red Canary and a SANS instructor. She said that as security defenders do a better job of blocking outbound clicks to malicious sites by blocking phishing attempts and the like, the attackers are adjusting by luring them through watering hole attacks. And SEO is playing into that scheme.
So, imagine some of you are in marketing and you’re using search engine optimization to get your company’s results to the top, explained Nickels. Well, adversaries do the same thing, but for evil, right? They use keywords and other SEO techniques to make sure their results, their malicious websites, are at the top of those search engine results.
Nickels walked through an example of a GootLoader attack that was propagated by using SEO to boost the rankings of a search for legal agreements to target unsuspecting users searching for an easy download of a legal document template.
Similar to how marketers utilize both organic search techniques via SEO and paid search techniques utilizing advertising, cybercriminals are doing the same. Nickels said drive-by attacks are also similarly fueled by malicious advertising (
malvertising
) campaigns that artificially boost the rankings of sites for certain keywords.
And fun fact, I did not actually plan this but malvertising was just added to MITRE ATT&CK as a new technique yesterday, she said.
The example she brought to light in this case was a lookalike campaign for a free piece of 3D graphic software called Blender.
Search for that and you get a couple ads and a couple of results, she said. That first ad, thats bad. Second one, if I click that, that would also be into a malicious website. The third ones gotta be legit, right? No, in this case, the third ad was also malicious. Its not until the fourth result on that keyword that you get the legitimate software website.
Adding to the challenge of these high rankings, she explained that the lookalike sites are near identical to the actual Blender website, as the bad guys are getting really good at mimicking certain sites like this.
While neither SEO-boosted attacks nor malvertising are brand-new techniques, she noted, the reason she put them at the top of her list is the increasing prevalence of these attacks this year.
Johannes Ullrich, dean of research for SANS Technology Institute College and head of the Internet Storm Center, said his pick for the year is cyberattacks targeting software and
application developers
.
What I noticed last year, I think thats something thats really going to increase, is that attacks are specifically targeting developers, Ullrich said. We talk a lot about dependencies and malicious components. The first individual in your organization thats exposed to these malicious components is the developer.
Developers are an extremely enticing target as they usually have elevated privileges across IT and business systems, the systems they use can be subverted to poison the software supply chain, and they tend to work on machines that are less locked down than the average user in order to enable them to experiment with code and ship software on the daily.
A lot of this endpoint protection software is sort of geared towards your random corporate workstation, Ullrich said. Theyre not necessarily used to or designed to protect systems that have developer tools installed.
With the
explosion of large language models (LLMs) like ChatGPT,
defenders should expect attackers — even very non-technical ones — to ramp up their development of exploits and zero-day discovery utilizing these AI tools. This was the attack technique highlighted by Steven Sims, offensive operations curriculum lead for SANS and a longtime vulnerability researcher and exploit developer.
Sims walked through the ease with which he could get ChatGPT to uncover a zero-day. He demonstrated some prompts he used by pointing it at a piece of code vulnerable to the SigRed DNS flaw that recently came to light and had it explore that code to find the flaw as if it was a zero-day flaw.
Additionally, he demonstrated the prompts he used to get ChatGPT to help him write code for a simple piece of ransomware. Though
ChatGPT does have some protections
built into the system to refuse to develop ransomware code, he was able to convince it by breaking the pieces down into discrete parts.
From a defensive perspective, there is basically nothing you can do. Sorry, Sims told the audience. Defensive depth is important. Expert mitigations is important. Understanding how this works is important. Writing your own AI and machine learning to understand more about it is important. These things are really all you can do because its out there and its amazing.
In addition to
technical offensive uses of AI
, expect attackers this year to drastically ramp up their use of AI to make their social engineering and impersonation attempts highly believable, warned Heather Mahalik, director of digital intelligence for Cellebrite and digital forensics and incident response lead for SANS.
She illustrated her point with a social engineering experiment she did with her son, prompting ChatGPT to write convincing texts — with emojis — that would make them sound like a 9-year-old girl trying to get her son to tell her his address.
It can be used to target people in your organizations, she said. I chose to target my son because I tried to make everything really personable and show that were all attackable.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
SANS Reveals Top 5 Most Dangerous Cyberattacks for 2023