Threat Actors Research Articles

Security and Privacy Perspectives of People Living in Shared Home Environments

Security and privacy (S&P) perspectives of people in a multi-user home are a growing area of research, with many researchers reflecting on the complicated power imbalance and challenging access control issues of the devices involved. However, these studies primarily focused on the multi-user scenarios in traditional family home settings, leaving other types of multi-user home environments, such as homes shared by co-habitants without a familial relationship, under-studied. This paper closes this research gap via quantitative and qualitative analysis of results from an online survey and qualitative content analysis of sampled online posts on Reddit. The study explores the complex roles of shared home users, which depend on various factors unique to the shared home environment, e.g., who owns what home devices, how home devices are used by multiple users, and more complicated relationships between the landlord and people in the shared home and among co-habitants. Half (50.7%) of our survey participants thought that devices in a shared home are less secure than in a traditional family home. This perception was found statistically significantly associated with factors such as the fear of devices being tampered with in their absence and (lack of) trust in other co-habitants and their visitors. We observed cyber-physical threats being a prominent topic discussed in Reddit posts. Our study revealed new user types and user relationships in a multi-user environment such as ExternalPrimary-InternalPrimary while analysing the landlord and shared home resident relationship with regard to shared home device use. Based on the results of the online survey and the Reddit data, we propose a threat actor model for shared home environments, which has a focus on possible malicious behaviours of current and past co-habitants of a shared home, as a special type of insider threat in a home environment. We also recommend further research to understand the complex roles co-habitants can play in navigating and adapting to a shared home environment's security and privacy landscape.

Machine Learning Approach for Classification of Cyber Threats Actors in Web Region

In the interconnected scape of today's internet, the dark web emerges as a concealed point, covering a myriad of illicit activities that pose substantial cybersecurity risks. This study investigates the attribution of threats within the dark web environment, leveraging on a machine learning approach to bridge the gap between technical indicators and linguistic and behavioral insights. Through a comprehensive methodology involving web crawling and data gathering, a dataset encompassing key variables such as attack motivation, method, web part, and threat actor was gathered. Principal Component Analysis was employed for feature selection, followed by the application of Multinomial Naive Bayes (MNB), Support Vector Machine (SVM), Random Forest (RF), and CatBoost algorithms for classification. Performance evaluation metrics including precision, recall, and F1-score were utilized to assess the efficacy of each algorithm. Results indicate a notable prevalence of cybercrimes within the dark web, underscoring the necessity for enhanced cybersecurity strategies tailored to address its unique challenges. Furthermore, the comparative analysis demonstrates varying performance levels among the machine learning algorithms, with Multinomial Naive Bayes exhibiting the highest accuracy. This research contributes to advancing threat attribution techniques in the dark web, ultimately aiming to bolster cybersecurity defenses and mitigate future cyber threats.

Adaptive Ransomware Detection Using Similarity-Preserving Hashing

Crypto-ransomware is a type of ransomware that encrypts the victim’s files and demands a ransom to return the files. This type of attack has been on the rise in recent years, as it offers a lucrative business model for threat actors. Research into developing solutions for detecting and halting the spread of ransomware is vast, and it uses different approaches. Some approaches rely on analyzing system calls made via processes to detect malicious behavior, while other methods focus on the affected files by creating a file integrity monitor to detect rapid and abnormal changes in file hashes. In this paper, we present a novel approach that utilizes hashing and can accommodate large files and dynamically take into account the amount of change within each file. Mainly, our approach relies on dividing each file into partitions and then performing selective hashing on those partitions to rapidly detect encrypted partitions due to ransomware. Our new approach addresses the main weakness of a previous implementation that relies on hashing files, not file partitions. This new implementation strikes a balance between the detection time and false positives based on the partition size and the threshold of partition changes before issuing an alert.

Enhancing Cybersecurity through AI-Powered Security Mechanisms

In the rapidly evolving landscape of digital technology, the proliferation of interconnected systems has brought unprecedented opportunities and challenges. Among these challenges, the escalating frequency and sophistication of cyberattacks pose significant threats to individuals, organizations, and nations. In response, the fusion of Cybersecurity and Artificial Intelligence (AI) has emerged as a pivotal paradigm, offering proactive, intelligent, and adaptable defense mechanisms. This research explores the transformative impacts of AI-powered security on cybersecurity, demonstrating how AI techniques, including machine learning, natural language processing, and anomaly detection, fortify digital infrastructures. By analyzing vast volumes of data at speeds beyond human capacity, AI-driven cybersecurity systems can identify subtle patterns indicative of potential threats, allowing for early detection and prevention. The exploration consolidates existing studies, highlighting the trends and gaps that this research addresses. Expanded results and discussions provide a detailed analysis of the practical benefits and challenges of AI applications in cybersecurity, including case studies that offer concrete evidence of AI's impact. Novel contributions are emphasized through comparisons with other studies, showcasing improvements in accuracy, precision, recall, and F-score metrics, which demonstrate the effectiveness of AI in enhancing cybersecurity measures. The synergy between AI and human expertise is explored, highlighting how AI-driven tools augment human analysts' capabilities. Ethical considerations and the "black box" nature of AI algorithms are addressed, advocating for transparent and interpretable AI models to foster trust and collaboration between man and machine. The challenges posed by adversarial AI, where threat actors exploit AI system vulnerabilities, are examined. Strategies for building robust AI security mechanisms, including adversarial training, model diversification, and advanced threat modeling, are discussed. The research also emphasizes a holistic approach that combines AI-driven automation with human intuition and domain knowledge. As AI continues to rapidly evolve, a proactive and dynamic cybersecurity posture can be established, bolstering defenses, mitigating risks, and ensuring the integrity of our increasingly interconnected digital world.

Planning and Preparation of Cybersecurity

In today's digital environment characterized by fast-evolving adversaries, expanded attack surfaces, and complex IT environments, having a formidable plan and being prepared could create a world of difference when faced with a potential cyber-attack. Cyber threats are growing risks to everyone and any institution. Cybercriminals target individuals and companies of all sizes. Today's attacks are agile and sophisticated. Ransom demands are elevating and advancing rapidly while attackers drill down their focus to specific victims like critical infrastructure businesses, which can spend millions of dollars in losses from cyber disasters since such companies have less tolerance for downtime. The evolution of artificial intelligence technology, which is more interesting and scarier at the same time, is impacting the field of cybersecurity. The negative side of AI is that it has enabled threat actors to blend new data theft-based extortion techniques into ransomware. Attackers can steal companies' sensitive data or even encrypt the data and demand ransom for the decryption key failure, to which they threaten the company to expose the data to the public or even trade in the dark web. The intelligent techniques and tactics utilized by threat actors are a clarion call for organizations to proactively plan and prepare adequately by developing a cybersecurity strategy as a countermeasure. A cybersecurity strategy is a comprehensive plan that stipulates an organizational approach to secure its IT infrastructure against cyber threats. The common cybersecurity strategy various organizations use to plan and prepare for inevitable attacks is the incidence response plan. Incidence response is the processes and technologies organizations use to detect and respond to cyber threats, security breaches, or cyberattacks within an organization. Developing and implementing a formal incident response plan allows organizations to minimize and prevent damage. This research paper focuses on the primary goal of the incident response of preventing cyberattacks prior to occurring and reducing the cost and business disruption emanating from cyberattacks that happen. Keywords – incident response, threats, Artificial intelligence, cybersecurity, threat attacks, plan, preparation.

The Future of Cyber Threat Intelligence: Anticipating and Preparing for Evolving Threats

Modern cybersecurity protocols face unprecedented hurdles from the dynamic cyber threat ecology. In this context, the value of cyber threat intelligence as a prophylactic protective strategy increase (Abu, Selamat, Ariffin , & Yusof, 2018). This study provides a futuristic analysis of cyber threat intelligence, emphasizing the vital role that it will play in anticipating and becoming ready for evolving threats. This article also looks at threat actor methods, attack paths, and emerging technologies in an attempt to illustrate the dynamic nature of cyber threats and the need for adaptive intelligence solutions (Abu, Selamat, Ariffin , & Yusof, 2018). Ethical and legal considerations are also explored to highlight the necessity for a thorough and responsible approach to the gathering and implementation of cyber threat intelligence (Wagner, 2019). Through this thorough examination, readers will get a substantial comprehension of the technical developments and strategic requirements that will impact how cyber threat intelligence is developed (Abu, Selamat, Ariffin , & Yusof, 2018) (Wagner, 2019). This will provide enterprises with the agility and resilience to predict, mitigate, and respond to future cyber-attacks.

Emerging Challenges and New Responses, Building Capabilities to Counter Threats in Cyberspace

Cyberspace phenomena are changing rapidly at international and national levels. Growing threats, new vulnerabilities and protection against them require continuous action at the level of the EU, NATO and national competent authorities and organisations. Adequate protection of critical infrastructure and cyberspace is a vital strategic, operational and technical challenge for the EU, NATO and therefore nations. Cross-border impacts, threat actors and malicious actions require coordination of international and national procedures, mechanisms and cooperation. This article presents the most important phenomena and trends experienced today, as well as EU and NATO initiatives and requirements at the strategic level, illustrating what changes can be expected in cybersecurity.

Comprehensive review of smart city cybersecurity strategies

With cities rapidly advancing technologically, the rise of smart cities brings innovative solutions to urban challenges. However, this integration of technologies within urban infrastructures introduces new cybersecurity risks. This review explores the cybersecurity issues that smart cities face and discusses strategies to address these threats. Smart cities rely on interconnected networks of devices and systems to enhance efficiency, sustainability, and citizen services. Yet, this connectivity also creates a complex environment that is vulnerable to cyberattacks. A key concern is the wide array of IoT devices deployed across smart city infrastructures, which often lack robust security mechanisms, making them susceptible to exploitation by cybercriminals. The interconnected nature of these systems heightens the potential impact of cyberattacks, posing significant risks to critical infrastructure, public safety, and privacy. Threat actors can exploit vulnerabilities in interconnected systems, disrupting essential services, manipulating data, or even causing physical harm. Since smart cities heavily depend on data-driven decision-making, ensuring data integrity and confidentiality is a top priority. To mitigate these risks, various cybersecurity strategies have been proposed and implemented. These include technical solutions, regulatory frameworks, and collaboration among stakeholders. Technical measures like encryption, authentication mechanisms, intrusion detection systems, and secure software development practices are essential. Additionally, strong access controls and network segmentation can limit the scope of potential attacks. Regulatory initiatives also play a crucial role in improving cybersecurity standards and ensuring compliance among stakeholders. Establishing clear guidelines for data protection, privacy rights, and incident response protocols is vital for safeguarding citizens' interests. Collaborative efforts between government agencies, the private sector, academia, and cybersecurity experts are crucial in sharing information and collectively defending against emerging threats. Securing smart cities requires a comprehensive approach that integrates technical measures, regulatory frameworks, and collaborative efforts to create a resilient and secure urban environment for all citizens. Keywords: Cybersecurity, Smart City, AI, Technology, Security.

Generative AI Increases Cybersecurity Risks for Seniors

We evaluate how generative AI exacerbates the cyber risks faced by senior citizens. We assess the risk that powerful LLMs can easily be misconfigured to serve a malicious purpose, and that platforms such as HackGPT or WormGPT can facilitate low-skilled script kiddies to replicate the effectiveness of high-skilled threat actors. We surveyed 85 seniors and found that the combination of loneliness and low cyber literacy places 87% of them at high risk of being hacked. Our survey further revealed that 67% of seniors have already been exposed to potentially exploitable digital intrusions and only 22% of seniors have sufficient awareness of risks to ask techno-literate for remedial assistance. Our risk analysis suggests that existing attack vectors can be augmented with AI to create highly personalized and believable digital exploits that are extremely difficult for seniors to distinguish from legitimate interactions. Technological advances allow for the replication of familiar voices, live digital reconstruction of faces, personalized targeting, and falsification of records. Once an attack vector is identified, certain generative polymorphic capabilities allow rapid mutation and obfuscation to deliver unique payloads. Both inbound and outbound risks exist. In addition to inbound attempts by individual threat actors, seniors are vulnerable to outbound attacks through poisoned LLMs, such as Threat GPT or PoisonGPT. Generative AI can maliciously alter databases to provide incorrect information or compromised instructions to gullible seniors seeking outbound digital guidance. By analyzing the extent to which senior citizens are at risk of exploitation through new developments in AI, the paper will contribute to the development of effective strategies to safeguard this vulnerable population.

Redefining cyber resilience : Through the risk register lens

Resilience is deeper than maintaining a company’s operations and services in the face of significant disruptions. It is the ability of a business to withstand, pivot and continue to grow in the face of a significant threat. To achieve resilience, companies must have an integrated, end-to-end understanding of how a specific threat magnifies the risks identified on their risk register, and what measures are needed across the enterprise to address the amplification of those risks. This paper details how the need for a holistic approach is especially important for cyber crises, compared with other types of crises, because they tend to have more broad-ranging impacts and complexities, such as: unclear timelines, lack of public empathy, unpredictable human threat actor(s), as well as a broader set of internal and external stakeholders that need to be engaged. Unlike other crises, cyber crises have the potential to magnify most — if not all — of the risks on the risk register. As such, cyber resilience requires ensuring that key stakeholders, whether shareholders, customers, regulators, business partners, employees, etc, stay resolute in their faith in a company and its leadership’s ability to navigate the increasingly complex issues related to cyber risks and how these issues are addressed enterprise-wide, not purely seen through the lens of technical or operational resilience. To achieve cyber resilience, organisations must develop and implement programmes that integrate both the technical and the broader business measures needed to limit fallout, demonstrate leadership through cyber crises, and deepen trust regardless of the potential severity of the impact.

Risks to cybersecurity from data localization, organized by techniques, tactics and procedures

ABSTRACT The risks of data localization to cybersecurity – organizational effects”, we provided a framework for the risks of data localization to cybersecurity, finding that 13 of 14 ISO 27002 controls would be negatively affected by the localization of personal data. This paper complements that analysis, focusing on the techniques, tactics and procedures (TTPs) of threat actors and defenders. Using the ENISA Guidelines and the MITRE ATT&CK Framework as authoritative approaches for cataloguing relevant TTPs, we highlight three important tactics that defenders use for cybersecurity purposes – threat hunting; privilege-escalation attack; and red teaming/pen testing. These three categories, considered essential to a mature cybersecurity programme, would routinely require cybersecurity defenders to access personal data that would be restricted by current data localization laws and proposals. The paper then provides a quantitative model illustrating the effects of data localization, finding that halving the number of IP addresses available to a defender would more than double the likely time until a new attack was detected. The paper concludes by noting that until and unless the proponents of localization address the unintended effects of data localization, scholars, policymakers and practitioners have strong reason to expect significant cybersecurity harms from hard localization requirements.

Health Data Re-Identification: Assessing Adversaries and Potential Harms.

Sharing biomedical data for research can help to improve disease understanding and support the development of preventive, diagnostic, and therapeutic methods. However, it is vital to balance the amount of data shared and the sharing mechanism chosen with the privacy protection provided. This requires a detailed understanding of potential adversaries who might attempt to re-identify data and the consequences of their actions. The aim of this paper is to present a comprehensive list of potential types of adversaries, motivations, and harms to targeted individuals. A group of 13 researchers performed a three-step process in a one-day workshop, involving the identification of adversaries, the categorization by motivation, and the deduction of potential harms. The group collected 28 suggestions and categorized them into six types, each associated with several of six distinct harms. The findings align with previous efforts in structuring threat actors and outcomes and we believe that they provide a robust foundation for evaluating re-identification risks and developing protection measures in health data sharing scenarios.

Data Exfiltration Anomaly Detection on Enterprise Networks using Deep Packet Inspection

Advanced persistent threats (APT) are threat actors with the advanced Technique, Tactic and Procedure (TTP) to gain covert control of the computer network for a long period of time. These threat actors are the highest cyber attack risk factor for enterprise companies and governments. A successful attack by the APT threat Actors has the capabilities to do physical damage. APT groups are typically state-sponsored and are considered the most effective and skilled cyber attackers. The final goal for the APT Attack is to exfiltrate victims data or sabotage system. This aim of this research is to exercise multiple Machine Learning Approach such as k-Nearest Neighbors and H20 Deep Learning Model and also employ Deep Packet Inspection on enterprise network traffic dataset in order to identify suitable approaches to detect data exfiltration by APT threat Actors. This study shows that combining machine learning techniques with Deep Packet Inspection significantly improves the detection of data exfiltration attempts by Advanced Persistent Threat (APT) actors. The findings suggest that this approach can enhance anomaly detection systems, bolstering the cybersecurity defenses of enterprises. Consequently, the research implications could lead to developing more robust strategies against sophisticated and covert cyber threats posed by APTs.

APT-scope: A novel framework to predict advanced persistent threat groups from enriched heterogeneous information network of cyber threat intelligence

Addressing the expanding Advanced Persistent Threat (APT) landscape is crucial for governments, enterprises and threat intelligence research groups. While defenders often rely on tabular formats for assets like logs, alerts, firewall rules; attackers leverage a graph-based mindset. In this work, we propose a novel multistage framework named APT-Scope which employs a comprehensive approach to Cyber Threat Intelligence (CTI) analysis on qualified real-world data. APT-Scope workflow consists of data gathering, enrichment, and analysis stages, where relationships between entities are used to construct a Heterogeneous Information Network (HIN). We applied CTI enrichment using additional active data collection techniques like DNS and Whois lookups, port scans, SSL footprinting, named entity recognition via SpaCy, and constructed a machine learning pipeline to predict relationships between entities using FastRP and Logistic Regression. By analyzing the resulting HIN, we discovered aliases for APT groups and predicted threat actors of APT attacks with unknown perpetrators. We observed AUCPR metrics as train score = 96.57% and test score = 92.36%. Our work is beneficial to oversee the entire APT landscape, steer ongoing and future CTI operations and make strategic decisions.

Membrane - Safe and Performant Data Access Controls in Apache Spark in the Presence of Imperative Code

Data Governance is an increasingly critical feature of modern cloud database systems, enabling administrators to set granular access policies on their data. AWS customers want to define row or column filtering on their blob storage data and access it using popular tools such as Apache Spark. AWS EMR provides a managed and serverless solution that lets users run Spark jobs in the AWS cloud with imperative and declarative programming against their data, while securely enforcing the fine-grained access controls defined on those datasets. Spark runs its compiler and scheduler alongside the user application and embeds user-defined functions in query plans, giving a threat actor direct access to its memory space. This introduces attack vectors such as information disclosure or privilege escalation during policy enforcement, in addition to well-researched threats such as SQL side channel attacks. In this paper, we present Membrane: a novel approach to secure query plans with declarative and imperative code. The innovation comes from splitting the Spark driver in two in order to rewrite query plans with security boundaries while avoiding traditional tradeoffs when using container isolation techniques. The approach described herein enables applying fine grained data access controls to both SQL and map-reduce Spark jobs, with negligible performance and cost differences.

Charting new waters with CRAMMTS: A survey-driven cybersecurity risk analysis method for maritime stakeholders

This article presents a novel survey-based cybersecurity risk assessment model, CRAMMTS (Cyber Risk Analysis Method for Maritime Transportation Systems), specifically designed for the maritime sector, addressing a critical gap in the literature. Our study contributes significantly in three ways: firstly, through a comprehensive critical literature review of 31 maritime guidelines and 95 scholarly articles, identifying the need for a new cybersecurity risk assessment method; secondly, by developing CRAMMTS, an adaptation of the ISRAM risk analysis method, incorporating the International Maritime Organization's criteria and enabling participation from maritime professionals, especially policymakers and leaders. The third contribution is a case study, the practical application of CRAMMTS in surveying 80 maritime professionals, assessing their perception of cybersecurity risks, and identifying varying risk levels, with the highest associated with cyber threat actors. This approach proved effective in assessing risks at both tactical and strategic levels and providing a clear, quantitative risk metric for decision-making. Our research underscores the maritime sector's need for a holistic, easily implementable cybersecurity risk analysis method that engages leaders and adapts to various Maritime Transportation System scopes, thereby enhancing cybersecurity risk assessment in this crucial domain.

Integrated model to optimize supplier selection and investments for cyber resilience in digital supply chains

Digitalization has revolutionized the supply chain networks but also introduces vulnerabilities to the cyber threats. Notably, in past two years, the cyber-attacks on different organizations worldwide have increased at an alarming rate resulting in significant financial loss to supply chains, intellectual property breaches and supply disruptions. As a result, companies are making significant investments in their cybersecurity. However, many incidents were reported where threat actors attacked a company using the shared digital systems with its suppliers. Therefore, it is important that suppliers are selected based on their cyber resilience. This paper identifies the cyber resilience criteria and proposed a multi criteria decision making based framework to evaluate the cyber resilience of a supply chain partner. It has been also realized that investment in organizational cybersecurity alone is not sufficient to protect supply chains. Companies are now investing in increasing their supply chain cyber capabilities. In this direction, paper also proposes a mixed integer linear program (MILP) to jointly optimize supplier selection and cyber investment decisions in a supply chain based on the supplier's current cyber resilience and potential return on the cyber investments made in selected suppliers. Computational experiments are conducted to study the tradeoffs and impact of sourcing strategy, supplier capacity, cyber security investment decisions on supply chain cyber resilience. The findings underscore that an integrated decision making of supplier selection and cyber investments maximizes the supply chain cyber resilience.

Survey-based analysis of cybersecurity awareness of Turkish seafarers

In recent years, vessels have become increasingly digitized, reflecting broader societal trends. As a result, maritime operations have become an attractive target for cyber threat actors. Despite the limited cybersecurity training seafarers receive, they are expected to operate within technologically advanced environments. The importance of cybersecurity awareness is evident, but the extent of seafarers’ knowledge in this area remains uncertain. This article investigates three primary aspects: (1) the current state of cybersecurity onboard cargo vessels, (2) seafarers’ cybersecurity awareness, and (3) potential improvements in seafarers’ cybersecurity awareness. To accomplish this, a literature review is conducted to collect and analyze current research, supplemented by a questionnaire survey targeting Turkish seafarers. Our findings support increased investment in awareness and training programs, including organizational-wide cybersecurity awareness efforts, more frequent training, mandatory training for all seafarers through the Standards of Training Certification and Watchkeeping (STCW), and the appointment of a cybersecurity Officer (CySO) to ensure satisfactory cybersecurity levels onboard. Since this article focuses on high-level topics by assessing the general state of maritime cybersecurity and seafarers’ cybersecurity awareness, it does not delve into detailed considerations of awareness and training programs. Nevertheless, it lays the foundation for future research in this area.

Unveiling Cyber Threat Actors: A Hybrid Deep Learning Approach for Behavior-based Attribution

In this paper, we leverage natural language processing and machine learning algorithms to profile threat actors based on their behavioral signatures to establish identification for soft attribution. Our unique dataset comprises various actors and the commands they have executed, with a significant proportion using the Cobalt Strike framework in August 2020-October 2022. We implemented a hybrid deep learning structure combining transformers and convolutional neural networks to benefit global and local contextual information within the sequence of commands, which provides a detailed view of the behavioral patterns of threat actors. We evaluated our hybrid architecture against pre-trained transformer-based models such as BERT, RoBERTa, SecureBERT, and DarkBERT with our high-count, medium-count, and low-count datasets. Hybrid architecture has achieved F1-score of 95.11% and an accuracy score of 95.13% on the high-count dataset, F1-score of 93.60% and accuracy score of 93.77% on the medium-count dataset, and F1-score of 88.95% and accuracy score of 89.25% on the low-count dataset. Our approach has the potential to substantially reduce the workload of incident response experts who are processing the collected cybersecurity data to identify patterns.

Exploring Cyber Fraud within the South African Cybersecurity Legal Framework

All countries are globally struggling with the challenges cybercrime presents to the cybersecurity legal framework. Fraud is not a new crime and existed long before the internet. The internet provides a threat actor access to a lot of potential victims and the use of various threat vectors to gain access to personal information by means of social engineering. It is therefore not surprising that cyber fraud has become a serious threat which continues to escalate globally. In 2021, around $100 million was lost in Canada due to online fraud. The United Kingdom (UK) Finance indicated that cyber fraud costs consumers more than £1.2 billion in 2022. The South African (SA) Fraud Prevention Services noted a 356% surge in identity fraud between April 2022 and April 2023. The cybersecurity threat landscape is ever-evolving with the UK Finance warning that the number of cyber frauds could surge out of control as threat actors begin to incorporate the use of Artificial intelligence (AI) to make their operations far more sophisticated and not as easily detected. In 2023 the United States (US) also warned that the irresponsible use of AI could exacerbate societal harms such as fraud. Cyber fraud, also referred to as a “white collar” or commercial crime, is an umbrella term to describe the commission of different types of cyber fraud by means of the use of various threat vectors. The threat vector used to commit the different type of fraud is continuously evolving, such as the use of sophisticated phishing to quishing and deep fakes which are aimed at deceiving the recipient in sharing information. The information obtained from a data breach may be used to commit cyber fraud. Irrespective of the threat vector used to commit fraud, all types of fraud present with the same elements, namely a threat actor who unlawfully and intentionally deceives a victim to benefit and cause harm. The discussion focuses on cyber fraud in general and not a specific type of cyber fraud. The purpose of the discussion is to provide an overview of the challenges cyber fraud present to the South African cybersecurity legal landscape.