top of page

Cybercrime on Main Street

Security vendor Sophos have published their 2024 threat report, 'Cybercrime on Main Street', that combines the data observed over 2023 with forecasting and predictions for the threat landscape of 2024. They state that while ransomware remains the top cyber threat , others are growing.

The Sophos report focuses on small to medium businesses as these tend to be the most frequent targets of cyber-crimes. This is likely due to the mixture of small businesses not being able to afford sufficient cyber defences, not being able to withstand the financial and reputation pressure cyber criminals can apply and generating enough revenue to still be profitable targets for threat actors.

The report touches on key threats, one being threat actors' transition away from simple social engineering towards more active engagement. This is likely due to the way that phishing defences are implemented; a never before seen email address attempting to send an unknown link or file to an internal user is likely to be flagged as suspicious or malicious on security controls.

However, by moving towards active engagement, a threat actor may reignite an old email chain with a compromised email address, bypassing the suspicion of a never before seen address.

Furthermore they are likely to maintain a text based conversation with the target for longer before presenting a malicious file or link.

With rapport building through compromised email chains, it can be harder for individuals to know if an attachment or link is safe, increasing the likelyhood of successful compromise.

Another key threat identified is the increasing abuse of drivers. At a basic level, a driver is a software component that allows a device's operating system to communicate with the device's hardware.

When an application needs to collect data from the hardware the request will go Application -> OS -> Driver -> Hardware. Drivers are an attractive threat vector as they can have a high level of access into a target device and are monitored less diligently compared to vulnerable application and vulnerable operating systems, allowing threat actors to compromise systems while evading defences.

The report emphasises that in the vast majority of cases, data is the prime target. It paves the way for threat actors to commit ransomware attacks, data extortion, remote access persistence, or data theft.



Report all Fraud and Cybercrime to Action Fraud by calling 0300 123 2040 or online. Forward suspicious emails to Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).



The contents of blog posts on this website are provided for general information only and are not intended to replace specific professional advice relevant to your situation. The intention of East Midlands Cyber Resilience Centre (EMCRC) is to encourage cyber resilience by raising issues and disseminating information on the experiences and initiatives of others. Articles on the website cannot by their nature be comprehensive and may not reflect most recent legislation, practice, or application to your circumstances. EMCRC provides affordable services and Trusted Partners if you need specific support. For specific questions please contact us by email.


EMCRC does not accept any responsibility for any loss which may arise from reliance on information or materials published on this blog. EMCRC is not responsible for the content of external internet sites that link to this site or which are linked from it.

bottom of page