www.darkreading.com Open in urlscan Pro
104.16.223.171  Public Scan

Form analysis
0 forms found in the DOM

Text Content

TechTarget and Informa Tech’s Digital Business Combine.TechTarget and Informa


TECHTARGET AND INFORMA TECH’S DIGITAL BUSINESS COMBINE.

Together, we power an unparalleled network of 220+ online properties covering
10,000+ granular topics, serving an audience of 50+ million professionals with
original, objective content from trusted sources. We help you gain critical
insights and make more informed decisions across your business priorities.

Black Hat NewsOmdia CybersecurityAdvertise

Newsletter Sign-Up

Newsletter Sign-Up

Cybersecurity Topics

RELATED TOPICS

 * Application Security
 * Cybersecurity Careers
 * Cloud Security
 * Cyber Risk
 * Cyberattacks & Data Breaches
 * Cybersecurity Analytics
 * Cybersecurity Operations
 * Data Privacy
 * Endpoint Security
 * ICS/OT Security

 * Identity & Access Mgmt Security
 * Insider Threats
 * IoT
 * Mobile Security
 * Perimeter
 * Physical Security
 * Remote Workforce
 * Threat Intelligence
 * Vulnerabilities & Threats


World

RELATED TOPICS

 * DR Global
 * Middle East & Africa

 * Asia Pacific

See All
The Edge
DR Technology
Events

RELATED TOPICS

 * Upcoming Events
 * Podcasts

 * Webinars

SEE ALL
Resources

RELATED TOPICS

 * Library
 * Newsletters
 * Podcasts
 * Reports
 * Videos
 * Webinars

 * Whitepapers
 * 
 * 
 * 
 * 
 * Partner Perspectives

SEE ALL


 * Vulnerabilities & Threats
 * Cyber Risk
 * Cyberattacks & Data Breaches
 * Threat Intelligence


EMERGING THREATS & VULNERABILITIES TO PREPARE FOR IN 2025EMERGING THREATS &
VULNERABILITIES TO PREPARE FOR IN 2025

From zero-day exploits to 5G network vulnerabilities, these are the threats that
are expected to persist over the next 12 months.

Kristina Beek, Associate Editor, Dark Reading

December 26, 2024

11 Min Read
Source: ktdesign via Adobe Stock


In 2024, we at Dark Reading covered a variety of attacks, exploits, and, of
course, vulnerabilities across the board. Here, we recount 10 emerging threats
organizations should be prepared for — as detailed by Dr. Jason Clark in "10
Emerging Vulnerabilities Every Enterprise Should Know," a Dark Reading webinar —
as they continuously rise and develop in 2025.


ZERO-DAY EXPLOITS

Zero-days and their increase in volume across the cybersecurity landscape is a
particularly concerning trend, as there is no patch for these bugs when they're
discovered. Attackers are also able to exploit systems using these
vulnerabilities undetected, as safeguards have not been put in place by
organizations or enterprises yet.



High-profile zero-day vulnerabilities include Log4Shell, tracked as
CVE-2021-44228, a critical RCE bug within Log4j's Java Naming and Directory
Interface (JNDI). By exploiting the vulnerability, attackers were able to easily
take control of vulnerable systems, a considerable threat as Log4j is used in
nearly every Java application.



Other vulnerabilities include PrintNightmare and Proxyshell, both remote
execution flaws that were exploited quickly and widely, according to Clark.

"The rise in zero-day exploits is partly driven by just more sophisticated
threat actors," Clark said in the Dark Reading webinar. "This can include things
like nation-states and also using them in targeted attacks."

Chad Graham, cyber incident response team (CIRT) manager at Critical Start,
however, believes that advancements with AI will change the landscape in 2025.



"Both attackers and defenders will rely on AI-driven tools to automate the
search for hidden software flaws," Graham says. "This shift will likely result
in a more dynamic cybersecurity landscape, where continuous innovation and
adaptation become the norm."


SUPPLY CHAIN ATTACKS

Supply chain attacks remain an active threat and tend toward the severe as their
impact cascades on to multiple parties: customers, suppliers, and other third
parties. Attackers exploit a trusted resource and ultimately gain access to not
just one organization, but multiple. These kinds of threats remain concerning as
organizations depend more and more on outsourcing services.



The best known example is the SolarWinds breach, which impacted the SolarWinds
Orion system, at the hands of a group known as Nobelium. More than 30,000
organizations — including state and federal agencies — used the Orion network
management system, resulting in the backdoor malware compromising thousands of
data, network, and systems.

Tracked as CVE-2020-10148 with a CVSS score of 9.8, the authentication bypass
bug allowed an unauthenticated attacker to execute API commands. The attackers
in question were advanced persistent threat (APT) actors who infiltrated into
the SolarWinds’ supply chain to insert a backdoor.

"The complexity of modern supply chains makes it challenging to secure all the
dependencies," Clark said in the webinar. "This underscores the need for
rigorous third-party risk management."

In the year ahead, Dana Simberkoff, chief risk, privacy, and information
security officer at AvePoint, believes that there will be a sharpened focus on
supply chains and third-party risk management.

"The CrowdStrike incident wasn't just a wake-up call — it was a stark reminder
that in our interconnected ecosystem, one weak link can trigger a catastrophic
chain reaction," Simberkoff says.


REMOTE WORK INFRASTRUCTURE EXPLOITS

Since 2020 and the COVID-19 pandemic, organizations have leaned into remote and
hybrid work offerings, increasing the risk of cybersecurity threats and becoming
a significant concern. Attackers focus on vulnerabilities that allow users to
engage in remote work such as VPNs, remote desktop protocols (RDPs), and
phishing attacks through platforms such as Zoom and Microsoft Teams.



There have been several notable incidents in which VPNs and RDPs were leveraged,
allowing threat actors to gain access to enterprise systems and networks. In
addition, remote workers are often operating from less secure environments,
causing an uptick in phishing attacks as the threat actors try to take advantage
of these blind spots.

"The shift to remote work has expanded the overall attack surface, Clark said in
the webinar. "Remote workers often need more security controls than those that
are working [onsite], which can lead to significant vulnerabilities."

Recent examples of vulnerabilities remote and hybrid work vulnerabilities
include CVE-2024-38199, a remote code execution vulnerability (RCE) in the
Windows or Line Printer Deamon (LPD) Service, and CVE-2024-21433, a Windows
Print Spooler elevation of privilege vulnerability.

"Remote work infrastructure will continue to be a prime target for
cybercriminals in 2025, with an increase in sophisticated attacks on cloud
services, VPNs, and collaboration tools," says Stephen Kowski, field CTO at
SlashNext Email Security+. "We'll likely see more AI-powered threats designed to
bypass traditional security measures, exploiting vulnerabilities in
interconnected devices and home networks."


EXPLOITATION OF AI AND MACHINE LEARNING SYSTEMS

With the rise of AI and its increasing use amid the public, comes widespread
risk of exploitation from attackers. Clark noted of adversarial attacks, data
poisoning, and model inversion attacks that are at the forefront of emerging
threats for AI and machine learning (ML) systems in particular. 

The nature of some ML systems requires feeding a system information for the best
results, the system becoming more familiar with the user over time. When attacks
target these systems, it can lead to unauthorized access to sensitive data
stored and processed within these tools, as well as incorrect predictions or
biased decisions.



"AI models will be key areas of exploitation in 2025," says Rom Carmel,
co-founder and CEO at Apono. "As AI and machine learning become integral to
identity verification systems, attackers will find ways to poison AI models or
bypass them."

AI can also simply be manipulated for malicious ends, as seen when an AI
deepfake robocall was created to impersonate US President Joe Biden to encourage
individuals not to vote in the New Hampshire's Democratic primary, an event that
could have had severe consequences on the US electoral process.

"The threat landscape is evolving with the rapid adoption of AI and ML," Clark
said in the webinar. "Attackers increasingly focus on these systems to undermine
their reliability and exploit vulnerability."


CLOUD MISCONFIGURATIONS

As organizations continue to shift their operations to the cloud, it will
continue to emerge as a space for threat actors to thrive, often due to the
cloud simply not being set up correctly.

Common examples of threats that circulate within the cloud are publicly
accessible S3 buckets, misconfigured security groups in AWS, and exposed
databases.

"Cloud misconfigurations can have severe impacts related to data breaches,
unauthorized access to critical systems, financial loss, and reputational
damage," Clark said. He added that the complexity of these environments is going
to increase leading to more frequent configuration errors.

In the past, Amazon and Microsoft cloud environments have exposed customer
data, such as viewing habits, names, email addresses, email content, and phone
numbers. The leaks aren't due to vulnerabilities but misconfigurations ranging
from insecure read-and-write permissions to inaccurate access lists and
misconfigured policies.

"To successfully prevent cloud breaches in 2025, companies need to focus on
three key areas: visibility, access control, and continuous monitoring," says
Jason Soroko, senior fellow at Sectigo. "Cloud environments are dynamic, so your
security needs to be dynamic too."




IOT DEVICE VULNERABILITIES

IoT devices are allowing for emerging threats to thrive, being easy targets for
threat actors to exploit, whether it be due to weak default passwords, lack of
encryption, or insecure firmware.

Common attacks that IoT devices face are data theft, network breaches, and
distributed denial-of-service (DDoS) attacks. A recent example emerged in the
Common Unix Printing System (CUPS) for managing printers and print jobs. The
series of vulnerabilities, tracked as CVE-2024-47176, CVE-2024-47076,
CVE-2024-47175, and CVE-2024-47177 could allow bad actors to stage DDoS attacks
within seconds for less than 1 cent while using an available cloud platform.

"Just the sheer volume of connected devices really exacerbates the threat,"
Clark noted in the webinar. "Securing these devices becomes really challenging
due to their diversity and often limited processing power for adding security
features."

And as the use of IoT, OT, and 5G networks continues to rise, organizations will
need cyber threat intelligence (CTI) to extend beyond traditional IT
environments, says Callie Guenther, senior manager, cyber threat
research at Critical Start. "This expansion, which will continue throughout
2025, will add complexity to CTI, requiring more granular insights and specific
intelligence data."


CRYPTOGRAPHIC WEAKNESSES

According to Clark, cryptographic weaknesses continue to pose a significant
threat because these kinds of vulnerabilities undermine the foundation of secure
communication and data protection. These weaknesses often manifest in one of two
ways: flaws in encryption algorithms, or how the algorithms are implemented.

"The rising threat is kind of compounded by the fact that as computational
capability advances, that previously secure crypto standard now becomes
increasingly more vulnerable," Clark said in the webinar.

He recommended regularly updating cryptographic libraries, and enforcing strong
encryption protocols to avoid exploitation attempts like man-in-the middle
attacks, data integrity issues, and the exposed sensitive information.

Just recently, Acros Security discovered a vulnerability, similar to
CVE-2024-38030, that enables an attack in which a vulnerable device is coerced
into sending NTLM hashes, which is the cryptographic version of a user's
password, to a threat actor.

"We have never before required from [cloud service providers] such granular and
detailed information on the type of encryption in use, but customers (government
and non-government customers alike) will require this level of detail to ensure
their encryption standards are being met," says Philip George, executive
technical strategist at InfoSec Global Federal.


API SECURITY GAPS

More organizations are relying on APIs to connect systems; however, these APIs
are at risk when they have flaws in the design or the implementation of the
APIs. Attackers are able to breach systems through unauthorized access, allowing
them to manipulate certain restricted actions.

A notable example of this is the exposure of user data through Facebook’s API,
though these flaws are also abundant in other sectors such as healthcare or
financial services. 

Gaps in API security ultimately serve as a launchpad, often for data breaches
which can lead to the loss of sensitive information, unauthorized transactions,
reputational damage, and significant financial loss.

"The threat is escalating as API is becoming more prevalent, increasing the
number of potential attack surfaces," Clark said. "To mitigate these risks, it's
essential to secure your API endpoints, enforce robust authentication
mechanisms, and regularly update and audit API access."

A Docusign API was recently used in a wide-scale phishing campaign due to its
"API-friendly environment," which is beneficial for businesses but also provides
a way for bad actors to conduct malicious operations. The flaw could ultimately
could have led to instances of fraud, though there are ways for users to avoid
and detect such API abuse.

In the coming year, the cyber landscape will continue to evolve, API being in
the forefront of these changes.

"We anticipate a rise in sophisticated API attacks using automation, artificial
intelligence, and advanced evasion techniques to exploit vulnerabilities and
bypass traditional security measures," says Eric Schwake, director of
cybersecurity strategy at Salt Security. "One significant risk will stem from
the exploitation of API misconfigurations, which often occur due to the fast
pace of development and deployment. This situation will challenge organizations
to adopt a more proactive and comprehensive approach to API security."


RANSOMWARE EVOLUTION

"We could do a whole webinar on ransomware," Clark said in the webinar, which
raises the question: Can ransomware even be considered an emerging threat? 

The answer is yes, though ransomware attacks have become one of the most
disruptive and costly cyberattacks out there largely due to their rapid
evolution.

One of the most notable ransomware attacks occurred on Colonial Pipeline, which
shut down its entire operations for the first time, leading to fuel shortages
and four states on the East Coast declaring a state of emergency. The ransomware
attack prompted action from national security and the executive branch and
forced a reevaluation of the nation's critical infrastructure security.

Threat actors know they can win big when demanding ransoms from organizations,
such as those in the healthcare sector, which will pay these high prices in
order to help patients in need.

"As these attacks are becoming more targeted and, frankly, aggressive, it's
crucial to start to implement backup strategies that are robust, strengthen your
overall incident response plans, and continuously educate your employees on
recognizing and avoiding things like phishing attempts that can often serve as
an entry point for ransomware," Clark said in the webinar.

Backups may not always be an option, according to Brandon Williams, chief
technology officer at Conversant Group.

"Some threat actors have moved to deleting data as part of their normal
motions," he says. "If this gains traction in 2025, organizations will not have
a method to recover by simply paying a ransom and hoping to get a working
decryption tool. The only method of recovery will be backups; however, data
shows that backups do not typically survive these breaches."


5G NETWORK VULNERABILITIES

5G networks are being rapidly deployed, and with them come threat actors'
awareness and exploitation of its vulnerabilities. Attackers are increasingly
able to target 5G infrastructure with ease, and these open the door for even
bigger threats such as large-scale DDoS attacks, unauthorized data access, and
disruption of our critical services.

"As we consider the rising threat, the global rollout of 5G brings an increasing
number of connected devices," Clark said in the webinar. "The rising number
amplifies their attack risk, particularly given their reliance on cloud-native
infrastructures."

At Black Hat 2024 in Las Vegas, seven Penn State University researchers detailed
how mobile devices are at risk of data theft and denial of service due to 5G
technology vulnerabilities. Threat actors use these resources simply by
providing someone with an Internet connection, allowing easy access to spying,
phishing, and more. 

"Vulnerabilities such as lack of initial broadcast message authentication,
spectrum slicing, silent downgrade, and unsecured DNS paging currently affect 5G
networks," says Mayuresh Dani, manager, security research, at Qualys Threat
Research Unit. "In the year to come, these will continue affecting 5G networks
and vulnerabilities in unsecured base stations will multiply snooping attacks."




ABOUT THE AUTHOR

Kristina Beek, Associate Editor, Dark Reading



Skilled writer and editor covering cybersecurity for Dark Reading.

See more from Kristina Beek, Associate Editor, Dark Reading
Keep up with the latest cybersecurity threats, newly discovered vulnerabilities,
data breach information, and emerging trends. Delivered daily or weekly right to
your email inbox.

Subscribe

You May Also Like

--------------------------------------------------------------------------------

Vulnerabilities & Threats

Why End of Life for Applications Is the Beginning of Life for Hackers
Vulnerabilities & Threats

A Lesson From the CrowdStrike Incident
Vulnerabilities & Threats

The CrowdStrike Meltdown: A Wake-up Call for Cybersecurity
Vulnerabilities & Threats

The Fall of the National Vulnerability Database
More Insights
Webinars

 * Securing Your Cloud Data Across the Attack Timeline
   
   Jan 15, 2025

 * The Artificial Future Trend Micro Security Predictions for 2025
   
   Jan 16, 2025

More Webinars



EDITOR'S CHOICE

Apache's logo on a mobile phone screen
Application Security
Orgs Scramble to Fix Actively Exploited Bug in Apache Struts 2Orgs Scramble to
Fix Actively Exploited Bug in Struts 2
byNate Nelson, Contributing Writer
Dec 19, 2024
5 Min Read

Cute bug on a leaf
Vulnerabilities & Threats
Fortinet Addresses Unpatched Critical RCE VectorFortinet Addresses Unpatched
Critical RCE Vector
byTara Seals, Managing Editor, News, Dark Reading
Dec 19, 2024
2 Min Read
Pipes in an industrial setting
Vulnerabilities & Threats
OT/ICS Engineering Workstations Face Barrage of Fresh MalwareOT/ICS Engineering
Workstations Face Fresh Malware Barrage
byBecky Bracken, Senior Editor, Dark Reading
Dec 19, 2024
1 Min Read

Reports

 * Managing Third-Party Risk Through Situational Awareness
   
   Jul 31, 2024

 * 2024 InformationWeek US IT Salary Report
   
   May 29, 2024

More Reports
Webinars

 * Securing Your Cloud Data Across the Attack Timeline
   
   Jan 15, 2025

 * The Artificial Future Trend Micro Security Predictions for 2025
   
   Jan 16, 2025

More Webinars
White Papers

 * IDC Analyst Brief: Enhancing Incident Response with Automated Investigation
   Workflows

 * Delivering Incident Response Excellence: How Wipro enhances customer services
   with automated investigation and response

 * 6 Key Requirements of Multicloud Security

 * Insider Risk Programs: 3 Truths and a Lie

 * Purple AI Datasheet

More Whitepapers






DISCOVER MORE

Black HatOmdia

WORKING WITH US

About UsAdvertiseReprints

JOIN US


Newsletter Sign-Up

FOLLOW US



Copyright © 2024. This website is owned and operated by Informa TechTarget, part
of a global network that informs, influences and connects the world’s technology
buyers and sellers. All copyright resides with them. Informa PLC’s registered
office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales.
TechTarget, Inc.’s registered office is 275 Grove St. Newton, MA 02466.

Home|Cookie Policy|Privacy|Terms of Use
Cookies Button


ABOUT COOKIES ON THIS SITE

We and our partners use cookies to enhance your website experience, learn how
our site is used, offer personalised features, measure the effectiveness of our
services, and tailor content and ads to your interests while you navigate on the
web or interact with us across devices. By clicking "Continue" or continuing to
browse our site you are agreeing to our and our partners use of cookies. For
more information seePrivacy Policy
CONTINUE




COOKIE POLICY

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Allow All


MANAGE CONSENT PREFERENCES

STRICTLY NECESSARY COOKIES

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms.    You can set your browser to
block or alert you about these cookies, but some parts of the site will not then
work. These cookies do not store any personally identifiable information.

PERFORMANCE COOKIES

Always Active

These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site.    All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

FUNCTIONAL COOKIES

Always Active

These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages.    If you do not allow these cookies then
some or all of these services may not function properly.

TARGETING COOKIES

Always Active

These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites.    They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

Back Button


COOKIE LIST



Search Icon
Filter Icon

Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Confirm My Choices