In 2023, the European Union (EU) continued to grapple with significant cyber threats, with ransomware attacks, child sexual exploitation (CSE), and online fraud remaining the most prominent manifestations of cybercrime according to a new report from Europol. In 2024 the cybercriminal landscape within the EU is marked by diversity, featuring both lone actors and sophisticated criminal networks offering a wide range of illicit services. While some of these cybercriminals operate from within the EU, many conceal their operations and funds in third countries to evade law enforcement.
The ongoing crackdown on cybercriminal forums and marketplaces has led to shorter lifecycles for these sites, as administrators seek to avoid drawing law enforcement attention. This has resulted in increased fragmentation of criminal marketplaces, compounded by a surge in exit scams. The abuse of legitimate end-to-end encryption (E2EE) messaging applications by cybercriminals has also seen a rise throughout the year.
Despite the adaptation of regulatory frameworks aimed at strengthening digital systems and enhancing user security, the human factor remains the weakest link in most cyber defense scenarios. Multi-layered extortion models have become increasingly common across the spectrum of cybercrime threats. Law enforcement actions have prompted ransomware groups to disband and reorganize, making it more challenging to distinguish between different ransomware brands and the threat actors behind them.
Artificial Intelligence (AI)-based technologies are enhancing the effectiveness of social engineering tactics. The criminal market for malware and phishing services mirrors the dynamics of legitimate industries, with the trade in stolen data emerging as the primary threat related to crime-as-a-service (CaaS). Malicious large language models (LLMs) are becoming prominent tools in the CaaS market, offering services on the dark web that assist online fraudsters in developing scripts and creating phishing emails. These LLMs are also being used in sexual extortion cases to refine grooming techniques.
Deepfakes are another growing concern in the cybercriminal arsenal. Used in online fraud to mimic voices for CEO fraud attempts and shock calls, their popularity is expected to increase. In the realm of CSE, AI-assisted, AI-altered, and fully AI-generated child sexual abuse material (CSAM) were reported in 2023 and are expected to become more prominent.
Main Threats
- Child Sexual Exploitation (CSE): The increasing volume of online CSAM poses significant challenges to law enforcement. Self-generated sexual material constitutes a growing share of detected CSAM.
- Cyber-Enabled Fraud: Investment fraud, business email compromise (BEC), and romance fraud remain prevalent in the EU, with phishing being the most common attack vector. Digital skimming continues to be a threat, leading to the theft, resale, or misuse of credit card data.
- AI and Machine Learning: Tools and services based on AI and machine learning are becoming standard tools for cybercriminals, particularly in the CaaS market. AI and deepfakes are refining social engineering capabilities, with malicious LLMs servicing offenders involved in cyber-attacks, phishing, and CSE.
Response and Adaptation
As a result of global law enforcement efforts targeting ransomware affiliates, operators, and the criminal digital infrastructure, ransomware groups have fragmented and reorganized under different guises. This ongoing adaptation highlights the dynamic nature of the cyber threat landscape and the need for continuous vigilance and innovation in cybersecurity measures.
To stay updated on the evolving cyber threat landscape and the latest cybersecurity measures in 2024, read the full threat assessment from Europol here.
