[Eye Opener] Attackers Don’t Hack, They Log In. Can You Stop Them?

The latest trend in cybercrime is that attackers don’t really focus on “hacking” in; they’re logging in.

We see this now in the wild, driven by organized criminal groups like Scattered Spider and BlackCat, who’ve re-emerged with a renewed focus on gaining access through legitimate means, often exploiting help desks and social engineering tactics.

Their strategies often rely on social engineering help desks into resetting credentials or bypassing multi-factor authentication (MFA), achieving access without breaking in. These attackers aim for the easiest route to your network, leveraging stolen credentials from info-stealers or posing as legitimate users to gain entry.

A recent case reported by ReliaQuest underscores this tactic. Scattered Spider used social engineering to trick a help desk, leading to a six-hour attack that ended in system encryption. The attackers even used Microsoft Teams to demand a ransom—showing a new level of boldness and ingenuity in modern cyberattacks.

As threat analyst Hayden Evans explains, “Attackers don’t hack in; they log in.” His advice is clear: organizations must enforce stringent help desk policies and ensure MFA configurations can withstand social engineering tricks.

To protect your network, work hard on improving employee training, monitoring for suspicious activity, and reinforcing help desk protocols. These measures build resilience against today’s advanced threat actors who bypass traditional security measures by simply logging in.