The most common cyberattacks in 2024

This article keeps its original 2024 focus as a historical snapshot. Individual campaigns change, but the core defensive practices remain useful.

Phishing and social engineering

Attackers often avoid breaking strong cryptography and instead persuade a person to disclose a password, approve a sign-in or open a harmful file. A message may imitate a bank, delivery company, manager or support desk.

In 2024, widely available content-generation tools made fraudulent messages more convincing. “Look for spelling mistakes” is no longer a sufficient defence. Teams need independent verification, mail filtering, regular awareness training and phishing-resistant multi-factor authentication.

Account takeover

Passwords reach criminals through reuse, third-party breaches, phishing and malware that steals sessions. Once an attacker controls email, they may reset access to other systems or continue conversations as the employee.

Useful controls include unique passwords in a manager, hardware security keys or passkeys, tighter privileged sessions, alerts for risky sign-ins and fast token revocation after an incident.

Ransomware and double extortion

File encryption is often the final stage of an established intrusion. Before that, attackers may explore the network, raise privileges and copy data. Restoring a backup therefore does not remove the risk of disclosure.

Backups should be separated from the primary identity domain, protected against alteration and tested through recovery exercises. Segmentation, least privilege, controlled remote access and prompt updates for exposed services are equally important.

DDoS attacks

A distributed denial-of-service attack overwhelms a network or application with traffic. It may be used to cause disruption or distract responders while another attack is underway.

Mitigation usually requires capacity at the provider, CDN or specialist filtering layer. Application caching, request limits and simplified emergency modes can help. The response plan should include provider contacts and clear activation thresholds.

Vulnerabilities in public services

VPN gateways, management panels, mail platforms and web applications are continuously scanned for known weaknesses. The problem is often not the absence of a fix but the delay between release and installation.

Organisations need a current inventory of public assets, named update owners, deadlines for critical patches and post-change verification. An unknown server will not appear in a patch plan and can become an easy entry point.

Supply-chain compromise

Every organisation depends on libraries, cloud services, contractors and build automation. Compromising one supplier may affect many customers.

Risk can be reduced with dependency inventories, pinned versions, signature checks, isolated build systems, short-lived secrets and minimal integration permissions. Critical suppliers should also have a documented emergency disconnection procedure.

A minimum defensive plan

1. Enable phishing-resistant authentication for email, administrators and remote access.
2. Maintain an asset inventory and patch critical issues within defined deadlines.
3. Test recovery from isolated backups.
4. Centralise logs and alerts for suspicious sign-ins and privilege changes.
5. Segment networks and remove standing excessive privileges.
6. Run short response exercises so everyone knows their role and contacts.

Security works best as several reinforcing layers. If one control fails, the others should contain the incident and support a reliable recovery.