Trustmi CEO Shai Gabay on How Cybercriminals Are Using AI to Scale Sophisticated Attacks

Hey guys, thanks for the throw. We're here with Shai Gbe, who's CEO for, trust Me, and we're having a little chat about how the bad guys are starting to weaponize AI in the forms that might be taking. Hey Shai, welcome to the show.

Hi. Hi Michael, how are you? I'm well, I'm well.

I think everybody's kind of conscious at this point that the AI that we see is a double-edged sword and the bad guys are certainly up to something, but nobody knows exactly what. So what are you guys seeing, because you're kind of on the front line of this thing. Yeah, you know, it's, um, really interesting because, uh, almost any conference, any meeting that I'm going, almost any place that you go, everyone was speaking about gen AI and what you can do with that.

And obviously if you're speaking with big enterprises, and that's most of our customers, basically, uh, everyone tell us that they try to experiment, they tried different things and you know, I think that in general, most of us are still in the basic area to try to experiment what we can achieve using gene ai. But on the other side, cyber criminals already started to utilize those type of capabilities. Long time ago, uh, we've seen much more sophistication in the attack, much more, uh, scales in those type of attacks on the automation, a lot of defects, uh, campaigns.

And they basically really take everything that they did before but leverage it in a very sufficient way. So obviously, uh, we're speaking with a lot of customers, all of them seeing it like, uh, uh, you know, the most classic example will be basically emails, right? Part of email, email attack will be, uh, what we did before.

We always tell, tell people and educate them that they can try to find typos or mis context or different problems in the email. But today, when they use chat, GPT or those type of tool to write those emails, you aren't going to see any problem with gar mail, any typos, any lack of context. It's going to be very clearly and very easy to see that it's written by a, Anytime there's a new innovation, we tend to use it to do what we always did a little bit faster until somebody comes up with some actual brand new use case for it.

So in the case of cyber criminals, have you seen them do anything truly innovative or are they just kind leveraging up on the scale to do what they always did faster? So I, I think it's a combination, right? Uh, at the end of the day, the, as a Tao, you always try to maximize your profit and minimize your, uh, effort, right?

That's how it work. At the end of the day, they doing business as part of what they do. Now, if you think about how payment works today and what's the process around it, it's a very complex process because first it involve a lot of different people, uh, that part of them inside of the organization, part of them outside of the organization, most of the communication based on email.

And there are a lot of different manual controls that are part of this process. Now, for data care to compromise the process, they try, they need to find different holes that they can exploit and just change bank details, change contact details, and do those type of things in order to hijack the conversation and basically change the destination of the funds, right? Because that's the goal.

They want to make sure that you send the money to their own place, that what they'll, um, basically try to achieve. Now, if you think about those complexity and those contours that are highly manual, so for the attacker, they can do simple things to automate those type of, uh, attacks to make it much more effective and they don't need to take it full blown to very sophisticated attack to be able to overcome, you know, a very common manual controls. Are we therefore looking at a world where the attacks themselves are increasing both in volume and sophistication?

So how do we combat that? Are we essentially gonna need AI to fight ai? Is this evolving into something that feels like an arm's race?

Yeah, uh, it's always like that. Um, you know, cyber criminal and cyber in general. It's a, a cat and mouse game.

You do something that side doing something else, you always try to, uh, stay ahead of them, but at the end of the day, that's exactly the point. If they're leveraging AI today in a very effective way, we need to start to, uh, use those type of tools as well in order to mitigate some of those cases. You know, when we are looking today, what's the most common controls in the organization?

I'm gonna say that there are two types. One going to be callback procedures. Basically try to authenticate if someone asks you to change your bank details, okay?

And the other type of that will be, uh, someone going to do an uh, type of, uh, there are different services today they try to offer a bank account validations, okay? Now, in both cases, the attacker today used different gen AI today to make it much harder for the defense to do those controls effectively. So if it will go back to the callback procedure, so obviously this is a manual process, right?

You are basically trying to verify that you're speaking with that person. So you call him in out ofAnd verification, but that's also line on the fact that you know who you're going to call. Now think about, I, I dunno, you are working with a vendor, you set it up five years ago and after five years someone ask you to change your band details.

That's really realistic scenario, right? It's something that happened. Businesses a lot of time need to change their band details.

Um, but now for example, five years later you can't, you can't really call the, the person that you set up the vendor was probably is not in this organization anymore. And then it's like, what are you going to call, call, just go going to do a simple Google search. Are you just going to, uh, call the number appearing in the, uh, email?

A lot of times also what we'll see that data attack do today, first they will do social engineering attack to make you change the contact details first or even, uh, they will do a DFA call and they will reach out to you to try to um, basically bypass that type of control. So that control become very, how to make it effectively. It's not only because it's manual, it's much more because the other side have much more better tools and technology available for him to make the change.

Okay? So if we'll take the other side folks. Uh, for, for now if we'll speak about bank account validations, you know, we see different services that provide those type of, um, validation.

Now, there are two problem of that approach as well. First, no one really has all the data. Banking is not a place that churn all the information.

So no one really have good coverage of all the bank details around the world, right? So inside the US you can probably get to 60% coverage outside of the US you can probably get 20% of coverage. But even that, even if you have the right coverage, we saw a lot of sophistication in the last two years.

Basically when the cyber criminal is going to compromise your suppliers, a lot of the time they're going after the finance people of the supplier and they're going to try to find proven previous, uh, communication and documents that they used to open their bank account. And after they will steal those type of documents, they're going to take that and they're going to the bank and they'll pass the courtesy of the bank. They'll open a legitimate account of behalf of the supplier, meaning semi official send everything, but probably it's going to be a different location.

So the only thing that you are verifying when you're doing those type of validation, you basically verify that the person that you communicate with has access to this account and a lot of times organization also add to that micro transaction, meaning I'll send you a small amount of few cents and I'll ask you how much money did you get? You know, the fraud will have because they have a legitimate account that you basically, uh, go going to verify. So basically saying that, uh, you don't really verify that this is the right account for this business and it doesn't say this is the right contact that you need to reach out to.

We also have seen the rise of AI agents and of course DeepFakes. Oh yeah, yeah. And will the bad guys take a more, um, measured approach to that because they'll create AI agents and deep fakes that seem like they're normal users and run them for months before they do something bad.

And so it looks like it's just a normal transaction when it's not. Yeah, and and that's exactly the point. Like if you look about most of the attacks, um, the attacker will try to exploit a trusted source with a really a lot of, uh, trust relationship.

Basically what we, they're usually doing, they're going after, um, a vendor that you already working for a long time ago, and when you, they will ask you to change your band, they'll impersonate someone that you know very well, you feel very comfortable with them and they going to explode that type of relationship. So it's not like, okay, it's going to be the first payment that they're going to, uh, make the fraud happen. It's going to be long the way That's exactly the, what they try to exploit.

What can be done about this? Uh, is this just a fact of life or do you think law enforcement and governments will get savvy about something? Is there something to be done that we should be doing as a society, but we're not?

So a a again, I think that yeah, obviously, uh, law enforcement can do a lot, but it's all about it's global problem. It's not something that it's only local. And I think that part of the problem is that a lot of places are not really showing information and there is no type of tools available today that you can really authenticate.

Are we speaking with? How are we doing it? And you are relying on a lot of old technology that try to do that, but at the end of the day, think about it even more, it's a classic people process technology bubble, okay?

Basically that I here are exporting a very complex process with a very old technology and people are the lowest link at the, at the end of the day because it's much easier to tweak them than took technology. Are we a little overly obsessed with defending the platforms and not enough on the processes, which are the very things that, And the people itself, it's not only that, But By the way, it's also a very interesting area. Think about like when I came from all time cybersecurity and defensive and the defense side, I was practitioner for a long time and you know, I remember when I started in cybersecurity, there wasn't a lot of tools for, uh, the classic employees and a lot of the time it was blaming if the employee click on malicious link.

It was why did it and stuff like that. And that changed because today we, we need to provide that the employees much better tools to be able to protect the organization. But that happened in general, it didn't happen in the finance area.

Okay? Think about the tools available today in most of the organization for the finance team, when they do running their payment cycle, they don't have a lot of great technology available for them to help them mitigate those, those type of flips. So does the role of the cybersecurity professional need to evolve then where they are a little more cognizant of the workflows and the processes because those are the things that ultimately need to be defended and are of the most value.

I think that at the end of the day, any business need to understand what is the accounts and what's the really critical part of their businesses. And I think that part of the reason that the attacker or cybercom are really like the problem that we're tackling is because they realize that, you know, it's much easier going after the people that has access to the funds itself and steal the money directly from them and try to do different type of attacks and won't get the same result at at the same level of efficiency. So what's that thing you see organizations doing today that just makes you shake your head and go, folks, we need to be a little bit better than that.

So again, a lot of manual controls, a lot of manual, uh, processes. You know, one of the thing that we see a lot is each time that they, that organization have an incident, they doing like a root cause analysis, try to understand what, what was broken in the process. Okay, and what what, usually you'll see that they will add another manual control to try to make sure that the previous attack or previous incident won't happen again.

By the way, it's make the process so complex that it's very hard to really understand what's really up and going on. So I, I'm, I, I think that that we need to, uh, create and use much more holistic approaches, really connecting the dots, really have full visibility to the entire process and remove go, going back from solid system, a lot of different people, each one doing their own thing. We need to have a much better understanding on the process end to end.

And to your point, the processes themselves are more complex. They're running at levels of scale and it's not clear to me that humans can keep pace with it anyway. So we need automate.

So I think it's also opportunity, um, you know, every time that you think about gen AI and what you can leverage, I think that the area of finance in a lot of, uh, places has a lot of opportunity for those type of improvement because there are a lot of repeatable tasks that can be achieved very easily, uh, by automation. Um, but again, it's really, uh, important to be able to, while you automate those type of things, you need to have the right controls because sometimes it's just quite much more damage. Yeah.

Well folks, you heard it. Here we are at some seminal point, but the one thing we can point to is, hey, the more manual processes there are, the more trouble you're likely to be in. Hey, Shai, thanks for being on the show.

Thank you so much. All right. And back to you guys in the studio.