Remote work, supply chains, commercial clouds offer threat actors social engineering opportunities to trick people into doing their bidding.
![A hand controls a small marionette. [control / manipulation / social engineering]](https://www.csoonline.com/wp-content/uploads/2025/05/572943-0-14112800-1746507016-hand_controls_small_marionette_puppet_control_manipulation_social_engineering_by_spiffyj_gettyimages-1182246224_2400x1600-100858607-orig.jpg?quality=50&strip=all&w=1024)
Threat actors exhibited โceaseless creativityโ last year when attacking the Achilles heel of every organizationโits human capitalโaccording to Proofpointโs annual The Human Factor 2022 report. The report, released June 2, draws on a multi-trillion datapoint graph created from the companyโs deployments to identify the latest attack trends by malicious players.
โLast year, attackers demonstrated just how unscrupulous they really are, making protecting people from cyber threats an ongoingโand often eye-openingโchallenge for organizations,โ Proofpoint Executive Vice President for Cybersecurity Strategy Ryan Kalember said in a statement.
The combination of remote work and the blurring of work and personal life on smartphones have influenced attacker techniques, the report notes. During the year, SMS phishing, or smishing, attempts more than doubled in the United States, while in the U.K., 50% of phishing lures focused on delivery notifications. An expectation that more people were likely working from home even drove good, old-fashioned voice scams, with more than 100,000 telephone attacks a day being launched by cybercriminals.
Insider threat risk increased
The report also found that risks posed by insider threats continue to increase. โLong-term hybrid work and the influx of incoming and outgoing employees from the โGreat Resignationโ has exacerbated the risks posed by insider threats,โ Proofpoint Vice President of Threat Research and Detection Sherrod DeGrippo tells CSO. โThereโs a lot more uncertainty around proper protocol, what data is or is not off-limits, and what the proper channels are that one should use.โ
Supplier risks include fake requests, phishing
Supply chain attacks were another significant development during the year. In any month, Proofpoint says 80% of its customers receive a threat that appears to come from one of its suppliers. Thatโs only slightly lower than its customers who receive any kind of threat. However, the report notes that supply chain threats are different from other kinds of threats because theyโre mostly phishing or imposter attacks, and rarely involve malware.
โSupply chain attacks via software or hardware vendors as well as third-party vendors are skyrocketing. Itโs no surprise that 80% of businesses are attacked by a compromised supplier account on a monthly basis,โ Rajiv Pimplaskar, CEO of SASE provider Dispersive Holdings, tells CSO.
Highly privileged users targeted
As might be expected, the reportโs researchers found that users with the highest privileges in an organization were also the most highly targeted by attackers. Managers and executives make up only 10% of overall users within organizations, it notes, but represent almost 50% of the most severe attack risk.
Threat actors leverage cloud providers
The researchers also report that adversaries are also corralling commercial cloud providers into their malicious schemes. One group, called TA571 by Proofpoint, will distribute emails with a link to a ZIP file hosted by OneDrive or Google Drive. When the compressed folder, which contains an Excel file, is opened, it drops URSNIF malware on a system, if macros are enabled in Excel.
In the vast majority of cases, human factors matter more than the technical specifics of an attack, the researchers maintain. Cybercriminals are looking for relationships that can be leveraged, trust that can be abused, and access that can be exploited.
Mitigating human factor attacks
The researchers recommend organizations deploy a solution that gives them visibility into whoโs being attacked, how theyโre being attacked, and whether they clicked on something malicious. Consider the individual risk each user represents, including how theyโre targeted, what data they have access to, and whether they tend to fall prey to attacks.
โOrganizations must find ways to leverage technology to solve these problems at scale before a human user is forced to be put on the front line,โ DeGrippo says. โWe cannot expect individuals to be the lone protection against attacks from operationalized and organized threat actor groups.โ